# Data Processing Agreement (DPA)

> Skeleton only – the GDPR Art.28-required contract between controller
> and processor. Structural format, not legal advice – counsel review
> required before signing.

## Parties

| Field | Controller | Processor |
|-------|------------|-----------|
| Legal name | [entity] | [entity] |
| Address | | |
| DPO / contact | | |

**Effective date**: YYYY-MM-DD
**Underlying agreement**: [main contract ref]

## 1. Subject matter & duration

Processing of personal data for [service description], for the
duration of the underlying agreement.

## 2. Processing details

| Item | Detail |
|------|--------|
| Nature / purpose | [what processing and why] |
| Duration | [term] |
| Data categories | [names, emails, usage, ...] |
| Data subjects | [customers, employees, ...] |
| Special categories | [none / list with Art.9 basis] |

## 3. Processor obligations

- Process only on documented instructions (Art.28(3)(a))
- Confidentiality undertakings for personnel
- Security measures per Annex [N] (TOMs)
- Sub-processors: [prior authorization / list + change notice]
- Assist with data-subject rights requests
- Assist with DPIAs and regulator consultations
- Delete or return data at end of service
- Allow and contribute to audits
- Notify personal data breaches without undue delay (<= NN h)

## 4. Sub-processors

Current list: [annex link]. Changes notified N days in advance;
controller may object on reasonable grounds.

## 5. International transfers

- Locations: [countries]
- Safeguards: [SCCs / adequacy / BCRs]

## 6. Liability & term

[Liability cap / allocation; survives termination for data held.]

## Signatures

| Controller | Processor |
|------------|-----------|
| @name, [title] | @name, [title] |
| Date: YYYY-MM-DD | Date: YYYY-MM-DD |

## Annex: Technical & Organizational Measures (TOMs)

- [access control / encryption / backup / availability measures]
- [incident response / personnel training / physical security]