Book a Demo
Business & contracts 2 signers 4 pages 19 blanks to fill in

Data Processing Agreement (DPA) Template

Put the rules in writing when a vendor handles personal data for your business: what it may do with the data, how it protects it, and what happens after a breach.

Use This Template — Free See the Agreement Signers don’t need an account
Data processing agreement
The blanks in brackets are what you fill in. VergeHR adds each signer’s signature and date boxes.
Data processing agreement — page 1 of 4
Page 1 of 4
Data processing agreement — page 2 of 4
Page 2 of 4
Data processing agreement — page 3 of 4
Page 3 of 4
Data processing agreement — page 4 of 4
Page 4 of 4
Use This Template Fill in the blanks, name who signs, and send — from VergeHR eSignature.

What is a data processing agreement?

A data processing agreement, often called a DPA or data processing addendum, is signed when a service provider handles personal data on a business's behalf. Common examples are a payroll bureau, a cloud host, an email platform or an IT support firm. The business decides why the data is used. The provider may only use it to deliver the service. Privacy laws such as the EU and UK GDPR require a written contract of this kind with a processor, and several US state privacy laws require similar terms with service providers.

This template sits alongside your main services contract. It covers the provider acting only on your documented instructions, with no selling, sharing or own-purpose use of the data. It also covers staff confidentiality, a baseline of security measures plus any you add, sub-processors with a notice-and-objection right, transfers between countries, help with individuals' requests, breach notice within the time you choose (24 to 72 hours), audits, and return or deletion at the end. You describe the services, whose data is involved and what types of data, and can list approved sub-processors and agreed storage locations.

Best for
Any business that uses a vendor to store, host or process personal data for it
Signed by
The business and the service provider, each through an authorised person
Breach notice
You choose 24, 36, 48 or 72 hours after the provider becomes aware
Length
About 4 pages, initialled on every page

When to Use a data processing agreement

  • Hiring a payroll or HR software provider that holds employee records
  • Moving your customer database to a hosting or cloud provider
  • Using an email marketing, CRM or customer support platform
  • Giving an IT support or development agency access to systems that hold personal data
  • A vendor's security questionnaire or a customer's audit asks whether you have DPAs in place

What You Fill In

19 blanks, then the name and email of each person who signs: business, service provider.

1 The parties

  • Effective date*
  • Business (company name)*
  • Business address
  • Service provider (company name)*
  • Service provider address

2 The services

  • The services agreement this supports*
  • What the service provider does with the data*

3 The data

  • Whose personal data*
  • Types of personal data*
  • Sensitive data included
  • Where the data is stored and processed

4 Security

  • Specific security measures

5 Sub-processors

  • Sub-processors already approved
  • Notice before adding a new sub-processor (days)*

6 Breaches and audits

  • Tell the business about a breach within* 24 hours · 36 hours · 48 hours · 72 hours
  • Notice before an audit (days)*

7 Ending

  • When the services end, the data is* returned to the Business and then deleted · deleted
  • Within (days after the services end)*
  • Governing law*

8 Who signs

  • Business signature and date, job title, initials on every page · The business that decides why and how the personal data is used (the "controller" under laws such as the GDPR).
  • Service provider signature and date, job title, initials on every page · The vendor that handles the personal data on the business's behalf (the "processor" under laws such as the GDPR).

What the data processing agreement Covers

  1. Definitions
  2. Roles and scope
  3. Instructions
  4. Confidentiality
  5. Security
  6. Sub-processors
  7. Location and transfers
  8. Helping the Business
  9. Security incidents
  10. Records and audits
  11. Return and deletion
  12. General

Using the data processing agreement, step by step

1 Link it to the main contract

Name the services agreement the DPA supports, such as "the Payroll Services Agreement dated 1 March 2026", and describe what the provider does with the data. If the two documents conflict on personal data, the DPA prevails.

2 Describe the data

Say whose data it is (customers, employees, website users) and what types (names, contact details, order history). Add any sensitive data, such as health or financial account information, so the provider knows extra safeguards apply.

3 Set security, sub-processors and locations

The agreement already lists baseline security measures. Add anything specific you have agreed. List the sub-processors you approve today and set the notice period for new ones. If the data must stay in certain countries, name them.

4 Choose breach, audit and exit terms, then send

Pick the breach notice time, the notice before an audit, and whether data is returned and deleted or just deleted when the services end. Add the provider's signer and send it for signature.

Tips Before You Send It

  • Some laws give the business itself a short deadline to report a breach to regulators or individuals. Choose a provider notice period that leaves you time to act.
  • If personal data will move between countries (for example out of the EU or UK), you may also need standard transfer clauses or another safeguard. This template requires them but does not include them.
  • Many large providers insist on their own DPA. Compare theirs with this one: instructions, sub-processor notice, breach timing and deletion are the key points.
  • Keep the sub-processor list current. It is often the first thing a customer or auditor asks for.

Sign It Online In Minutes

  1. Fill in the blanks. Names, dates and amounts go straight into the agreement — the preview shows exactly where.
  2. Name who signs. Tick “This is me” for your own part. VergeHR builds the PDF with every signature, date and initials box on the right line, and you can check or move anything before sending.
  3. Send it. Each signer gets a secure link and signs from any device — no account needed. The signed PDF, with an audit trail and a Certificate of Completion, is filed in Files and emailed to everyone.
Use the data processing agreement Template — It’s Free

Data processing agreement: frequently asked questions

Do I need a data processing agreement?

If a vendor handles personal data for your business and you are subject to a law such as the GDPR or UK GDPR, a written processor contract is required. Several US state privacy laws require similar contract terms with service providers. Even where it is not required, a DPA sets clear rules on security and breaches.

What is the difference between a controller and a processor?

The controller (the "Business" in this template) decides why and how personal data is used. The processor (the "Service Provider") handles it only on the controller's behalf and instructions. For two organisations that each use shared data for their own purposes, use a data sharing agreement instead.

Does this template include the EU standard contractual clauses?

No. It requires any transfer between countries to comply with data protection law, including any transfer agreement the law requires. If your data leaves the EU or UK, add the appropriate transfer clauses separately.

Can a DPA be signed electronically?

Yes. Electronic signatures are generally valid for ordinary commercial contracts in the US (ESIGN Act and UETA), the UK, the EU (eIDAS) and Canada, and the GDPR accepts a processor contract in electronic form. VergeHR keeps an audit trail with the signed PDF.

Use This Template — Free