What is a Data Processing Agreement (DPA)?

A Data Processing Agreement is a contract required under Article 28 of the UK GDPR and EU GDPR whenever a controller engages a processor to handle personal data on its behalf. It sets out the subject matter, duration, nature and purpose of processing, the type of personal data, the categories of data subjects, and the rights and obligations of both parties.

What are the key components of a DPA?

Key components include the processing description, controller's documented instructions, processor confidentiality and security obligations, sub-processor controls, assistance with data subject rights, breach notification timelines, audit rights, international transfer safeguards, and end-of-term return or deletion.

Do I need a DPA with every vendor?

You need a DPA with every vendor that processes personal data on your behalf, including cloud providers, SaaS tools, analytics platforms, payroll bureaux, customer support outsourcers, and AI vendors processing personal data in prompts or training.

Is this Data Processing Agreement template customisable?

Yes. The DPA generator captures your specific processing details, sub-processor list, transfer mechanisms, and security measures, and produces a personalised template you can review with counsel before signing.

What format is the DPA template available in?

The Data Processing Agreement template is generated as a professional PDF you can sign in person, electronically, or in counterparts.

Is the DPA template lawyer-reviewed?

All MyPitchDecks legal templates, including this DPA, are professionally drafted and lawyer-reviewed. Every controller-processor relationship is unique, so we recommend an attorney or Data Protection Officer reviews your customised version before execution.

Data Processing Agreement (DPA) Template

Name: Data Processing Agreement (DPA) Template
Brand: MyPitchDecks
SKU: MPD-DPA-001
Price: 1 GBP
Availability: InStock
Rating: 4.9 (3847 reviews)

Agreement Information

Agreement Number:

Agreement Date:

Effective Date:

Term of the DPA:

Processing Relationship:

Underlying Services Agreement:

Controller Information

Controller Name / Entity:

Controller Entity Type:

Controller Registered Address:

Company / Registration Number:

ICO Registration Number (UK):

Primary Contact Name:

Contact Title:

Contact Email:

Data Protection Officer (if any):

Processor Information

Processor Name / Entity:

Processor Entity Type:

Processor Registered Address:

Company / Registration Number:

ICO Registration Number (UK):

Primary Contact Name:

Contact Title:

Contact Email:

Data Protection Officer (if any):

Processing Description (Annex 1)

Subject Matter of Processing:

Duration of Processing:

Purpose of Processing:

Nature of Processing:

Categories of Data Subjects

Controller's customers and prospects

Controller's end users

Controller's employees

Job applicants

Suppliers and partners

Minors (under 18)

Website visitors

Special Category Data (Article 9)

Tick only the special categories the Processor will actually handle. Leaving these blank means no special category data is in scope.

Health data

Racial or ethnic origin

Political opinions

Religious or philosophical beliefs

Trade union membership

Genetic data

Biometric data for unique identification

Sex life or sexual orientation

Criminal convictions or offences (Article 10)

Sub-Processors

Sub-Processor Authorisation:

Notice Period for New Sub-Processors:

Controller's Right to Object:

Approved Sub-Processors

International Data Transfers

Transfer Mechanism:

SCCs Module (if applicable):

Transfer Risk Assessment Completed:

Supplementary Measures:

Destination Countries

Security Measures (Annex 2)

Additional Security Measures:

Breach Notification

Notification SLA from Awareness:

Notification Method:

Controller's Breach Notification Contact:

Audit Rights and Assurance

Permitted Audit Frequency:

Audit Notice Period:

Third-Party Assurance Accepted:

Audit Cost Allocation:

End of Term: Return or Deletion

End-of-Term Action:

Deletion Timeline (live data):

Deletion Timeline (backups):

Return Format:

Statutory Retention Carve-Outs:

Liability and Governing Law

Governing Law:

Exclusive Jurisdiction:

Data Protection Liability Cap:

Indemnification:

General Notes / Bespoke Terms:

Approval and Signature Information

Controller Signatory Name:

Controller Signatory Title:

Processor Signatory Name:

Processor Signatory Title:

Execution Format:

Witness / Notarisation:

Data Processing Agreement Generator