Free Data Processing Addendum (DPA) Template

DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") forms part of the [AGREEMENT NAME] dated [DATE] ("Agreement") between [CUSTOMER LEGAL NAME] ("Customer") and [VENDOR LEGAL NAME] ("Processor").

1. DEFINITIONS. "Personal Data" means information relating to an identified or identifiable individual that Processor processes for Customer under the Agreement. "Data Protection Laws" means all privacy and data protection laws that apply to the processing, including US state consumer privacy laws such as the California Consumer Privacy Act as amended, and, where applicable, the EU and UK GDPR. "Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

2. ROLES AND SCOPE. Customer is the controller (or business) and Processor is the processor (or service provider or contractor). Details of the processing are in Annex 1.

3. INSTRUCTIONS. Processor will process Personal Data only on Customer's documented instructions, including the Agreement, and only to provide the services. Processor will inform Customer if it believes an instruction violates Data Protection Laws.

4. RESTRICTIONS. Processor will not: sell or share Personal Data; retain, use or disclose it for any purpose other than performing the services, including training machine learning models; combine it with other data except as permitted by Data Protection Laws; or process it outside the direct business relationship with Customer. Processor certifies that it understands and will comply with these restrictions.

5. CONFIDENTIALITY. Processor will ensure that personnel authorised to process Personal Data are bound by confidentiality obligations.

6. SECURITY. Processor will implement appropriate technical and organisational measures described in Annex 2, including encryption in transit and at rest, access controls, logging, vulnerability management and staff training.

7. SUBPROCESSORS. Customer authorises the subprocessors listed in Annex 3. Processor will give at least [30] days' notice of new subprocessors, and Customer may object on reasonable data protection grounds; if unresolved, Customer may terminate the affected services with a refund of prepaid fees. Processor will impose data protection terms on subprocessors at least as protective as this DPA and remains liable for their performance.

8. SECURITY INCIDENTS. Processor will notify Customer without undue delay, and within [48] hours, after becoming aware of a Security Incident, providing the information reasonably available about its nature, scope, affected data and remediation, and will cooperate with Customer's investigation and any required notifications.

9. ASSISTANCE. Processor will assist Customer, taking into account the nature of processing, in responding to individuals' requests to exercise rights (access, deletion, correction, portability, opt-out), and with data protection assessments and consultations with regulators.

10. DELETION OR RETURN. On termination of the services, Processor will, at Customer's choice, return or delete all Personal Data within [30] days, and certify deletion on request, except where retention is required by law, in which case it remains protected by this DPA.

11. AUDITS. Processor will make available information reasonably necessary to demonstrate compliance, including its most recent [SOC 2 Type II report / ISO 27001 certificate]. Customer may conduct an audit once per year on [30] days' notice, or after a Security Incident, at Customer's cost, subject to confidentiality.

12. INTERNATIONAL TRANSFERS. Processor will not transfer Personal Data outside [the United States / the EEA] without Customer's consent and appropriate safeguards, such as the EU Standard Contractual Clauses where required.

13. LIABILITY. Each party's liability under this DPA is subject to the limitations in the Agreement[, except that the Agreement's data breach cap applies to Processor's breach of this DPA].

14. PRECEDENCE. If this DPA conflicts with the Agreement on the processing of Personal Data, this DPA controls.

CUSTOMER: _____________________  Date: __________
PROCESSOR: ____________________  Date: __________

ANNEX 1: Details of processing (subject matter, duration, nature and purpose, types of Personal Data, categories of individuals)
ANNEX 2: Technical and organisational security measures
ANNEX 3: Authorised subprocessors (name, location, service)

---
This free template is provided by ClauseAudit for general informational purposes and is not legal advice. Have it reviewed before use. Replace all [BRACKETED] placeholders.