Free Data Processing Agreement Generator

A Data Processing Agreement (DPA) is a contract between a business that controls personal data and a service provider that processes the data for it.

The General Data Protection Regulation (GDPR) calls the business the controller and the service provider the processor. Article 28 of the GDPR asks for this contract and lists what it covers.

A software or service business is usually the processor of the personal data its customers store in the product, and the DPA sets the rules for that data.

Yes, the Data Processing Agreement Generator from TermsFeed is free to use.

A one-time purchase or a paid plan removes the TermsFeed credits link and adds more features, such as downloads and the Text Editor.

Yes, you need a Data Processing Agreement when you process personal data for business customers in the EU, the UK or Switzerland.

Article 28(3) of the GDPR asks every controller for a contract with each processor of its personal data. The UK GDPR has the same rule for customers in the United Kingdom. In Switzerland, Article 9 of the Federal Act on Data Protection (FADP) lets a business hand personal data to a processor only under a contract or a law.

Business customers ask for a DPA before they buy, because the law puts the contract on them as controllers.

Answer the questions of the Data Processing Agreement Generator, then publish the DPA next to your terms or send it to your customers to sign.

A Data Processing Agreement includes the details of the processing and the obligations of the processor that Article 28(3) of the GDPR lists.

The details name the subject matter, the duration, the nature and the purpose of the processing, the types of personal data and the categories of people the data is about.

The obligations cover documented instructions, confidentiality, security measures, subprocessors, help with requests from data subjects, help after a data breach, deletion or return of the data at the end of the contract, and audits.

The Data Processing Agreement Generator puts the processing details in Annex I, the security measures in Annex II and the subprocessors in Annex III.

You are a processor for the personal data you handle for your customers, and a controller for the personal data you collect for your own business.

A project management app, for example, processes the tasks and contacts its customers add, so it is their processor for that data. The same app is the controller of the names and billing details of its own account holders.

The Data Processing Agreement covers the processor side, and your Privacy Policy covers the data you control. Create both with TermsFeed.

Yes, you need Standard Contractual Clauses (SCCs) or another safeguard when personal data leaves the European Economic Area (EEA) for a country without an adequacy decision.

The European Commission approved the current SCCs in Implementing Decision (EU) 2021/914. The UK adds its International Data Transfer Addendum to them, and Switzerland accepts them with a few changes.

A company in the United States certified under the EU-U.S. Data Privacy Framework receives data from the EU without SCCs, under the adequacy decision for that framework.

Select the safeguards you use in the generator, and the DPA adds the matching clauses.

A subprocessor is a company that processes personal data for your customers on your behalf, such as a hosting provider, an email service or a support tool.

Article 28(2) of the GDPR lets a processor engage a subprocessor only with the written authorization of the controller. A general authorization in the DPA covers the current list, with notice before each new subprocessor and a right for the customer to object.

The generator lists your subprocessors in Annex III, or links to the page where you keep the list.

Report a personal data breach to your customers without undue delay after you become aware of it.

Article 33(2) of the GDPR asks the processor to notify the controller without undue delay. The controller then has 72 hours to notify the supervisory authority (Article 33(1)), so a DPA sets a deadline in hours for the processor.

The Data Processing Agreement Generator writes the deadline you choose into the DPA: 24, 48 or 72 hours.

Your customers sign the Data Processing Agreement, or accept it as part of your terms of service.

Article 28(9) of the GDPR asks for the contract in writing, and electronic form counts. A DPA published on a page and named in your terms reaches every customer at once. A customer that asks for a signed copy gets a document with signature lines.

Select signature lines in the generator, then download the DPA as DOCX to sign.

Create a Data Processing Agreement with the Data Processing Agreement Generator in 4 steps.

1. Enter the website or app your customers use.

2. Enter your business details and your country.

3. Answer the questions about the personal data you process, your subprocessors and your security measures.

4. Publish the DPA with its Live Link, or download it and send it to your customers.