[This template is shared publicly on https://www.iubenda.

com/en/help/7680-
data-processing-agreement-template-gdpr]

DPA - model - English

Data Processing Agreement (DPA)

pursuant to art. 28 General Data Protection Regulation (GDPR)

by and between

 ................................................................................................
o the Controller 

[if applicable: Authorised Representative as of art. 27 GDPR:

................................................................................................]

 .................................................................................................
o the Processor 

[if applicable: Authorised Representative as of art. 27 GDPR:

................................................................................................]

1. Subject matter, term, personal data processed, and categories of

data subjects

(1) Subject matter

o The subject matter of this DPA consists of the appointment of the
Processor by the Controller and the provision of instructions for the
processing of personal data. The processing activities that the
Processor shall carry out are strictly limited to those necessary to
fulfil the scope of the main contract signed by the parties on [insert
date].
[or
o The Processor shall carry out the following processing activities on
behalf of the Controller:
..............................................................................................................
..............................................................................................................
..............................................................................................................
 ..............................................................................................................
..............................................................................................................]
 
(2) Term

o The term of this DPA corresponds to the term of the main contract. 
[alternatively: specify term]

(3) Categories of personal data

o The categories of personal data processed are:
 personally identifiable information (e.g. name, surname, email)
 statistical or other usage data observed on the internet (e.g. via
analytics, services etc.)
 customer history
 billing, invoicing and payment data
 other:….................................................. [please specify in detail,
especially if genetic, biometric or other sensitive data are
processed]

(4) Categories of Data Subjects

o The personal data collected and processed related to:
 customers
 potential customers
 internet users
 employees, associates, staff members 
 internal consultants
 authorised agents
 other:….................................................. [please specify]

2. Data Transfer Abroad

(1) The Processor undertakes not to transfer any personal data abroad (i.e. outside
the EEA territory) without the prior written authorization of the Data Controller.
Any data transfer abroad, and processing activities thereof, will be carried out in
strict compliance with the Controller's documented and specific instructions.

[option 1 no data transfer] 

(2) Both parties mutually acknowledge and agree that the data processing activities
under this agreement will not take place outside of the EEA.

[alternatively, in case of data transfer abroad]

(2) At the date of signature of the present agreement, the Controller acknowledges
that it has been informed that the following data processing activities, carried out by
the Processor on its behalf, will take place outside of the EEA.
Such processing activities, which are hereby specifically authorized by the
Controller, will take place in the states listed below and in strict compliance to the
legal bases for data transfer set forth in articles. 45 and ss. GDPR, as applicable to
each processing activity.
A B C
1 country data processing legal basis for
activity transfer
2 e.g. Switzerland e.g. hosting service e.g. adequacy decision
3
4
5
6

(The main legal bases for transfer pursuant to the GDPR are:
o an adequacy decision issued by the European Commission (Article 45
Paragraph 3 GDPR);
o binding corporate rules (Article 46 Paragraph 2 Point b in conjunction
with Article 47 GDPR);
o Standard Contractual Clauses (Article 46 Paragraph 2 Points c and d
GDPR);
o Codes of Conduct (Article 46 Paragraph 2 Point e in conjunction with
Article 40 GDPR);
o Certification Mechanism. (Article 46 Paragraph 2 Point f in conjunction
with Article 42 GDPR).
 For each processing activity listed in the table, select the applicable option from the
list above)

3. Technical and Organisational Measures

 (1) Prior to the execution of this DPA, the Processor undertakes to adopt all the
necessary technical and organisational security measures and to provide the
Controller with a document whereby all such measures are described in detail, also
in specific reference to the present agreement.

Such measures are subject to the Controller's scrutiny and to its prior approval. 
Upon the Controller's approval, such security measures, documented as above, will
become an integral and substantial part of this agreement and are hereby
incorporated by reference. Insofar as an inspection/audit by the Controller shows
the necessity for amendments, such amendments shall be implemented by mutual
agreement.

(2) The Processor warrants that it has taken all the security measures in accordance
with Article 28 Paragraph 3 Point c, and Article 32 GDPR in particular in conjunction
with Article 5 Paragraph 1, and Paragraph 2 GDPR. Such measures shall guarantee
data security and a protection level adequate to the level of risk concerning
confidentiality, integrity, availability, and resilience of the systems. According to
Article 32, par. 1 GDPR the following must be taken into account when assessing the
appropriateness of the security measures adopted: whether or not the measures can
be reasonable considered to be state-of-the-art, the implementation costs, the
nature, scope and purposes of processing as well as the likelihood of data breaches
and the severity of risks to the rights and freedoms of natural persons.

 (3) The technical and organisational measures are subject to technical and
technological progress and development. Hence, the Processor may adopt
alternative adequate measures which are up to date with the changed technological
environment. When doing so, the processing security level may not be reduced.
Substantial changes must be documented.

4.Data subjects rights

(1) The Processor undertakes to provide full cooperation and assistance, as it may

be reasonably possible, in order to assist the Controller in responding to data
subjects' requests for the exercising of their rights. 

(2) In particular, the Processor undertakes to (i) immediately communicate to the

Controller any request received by data subjects concerning the exercising of their
rights and, if feasible and appropriate, to (ii) enable the Controller to design and
deploy all the technical and organisational measures necessary to answer the data
subjects' requests.

(3) Notwithstanding the fact that the Controller bears the responsibility to respond
to the data subjects' requests, the Processor can accept to be tasked with the
fulfilment of some specific requests, provided that such tasks do not require
disproportionate efforts from the Processor and that the Controllers provides
detailed instructions in writing.

5.Further duties of the Processor

In addition to complying with the provisions of this DPA, the Processor commits to
meet all applicable statutory requirements set forth at Articles 28 to 33 GDPR. To
this end, the Processor warrants compliance with the following:

o Appointment of a Data Protection Officer (DPO)The current DPO

is:
(FULL CONTACT DETAILS)....................................................................
..............................................................................................................
.............................................................................................................. The
Processor shall inform the Controller without delay about any
changes of Data Protection Officer.

[or The Processor is not required to appoint a Data Protection Officer.

 Mr/Ms [insert given name, surname, organisational unit, telephone, e-
mail] is designated as the Contact Person on behalf of the Processor.]

o [→ pick only if applicable] Appointment of a Representative

Since the Processor is established outside the EU & EEA it has
designated
(FULL CONTACT DETAILS)....................................................................
..............................................................................................................
.............................................................................................................. as
Representative within the Union pursuant to Article 27 Paragraph 1
GDPR.

o Confidentiality
Processing activities under this DPA shall only be performed by
individuals (such as employees, agents, or staff members) that have
been instructed by the Processor on the appropriate way to process
data and have been contractually subjected to confidentiality
pursuant to art. 28 par. 3 (b) and art. 32 GDPR.  The Processor, and
any person acting under its authority who has access to the personal
data, shall not process that data unless acting upon instructions given
by the Controller — including the powers granted under this DPA  —
unless they are required to do so by statutory law. 

o Technical and Organisational Measures

Implementation of, and compliance with, all appropriate technical and
organisational measures in the framework of this DPA, in particular as
set forth at art. 32 GDPR. The Processor shall periodically monitor the
internal processes and the technical and organisational measures to
ensure that processing activities pertaining to it are carried out in
accordance with the requirements of applicable data protection law
and the protection of data subjects' rights. The Processor shall grant
verifiability of the technical and organisational measures to the
Controller as part of the Controller’s supervisory powers referred to
in sec. 7 of this contract.

o Cooperation with Supervisory Authorities

The Controller and the Processor shall cooperate, on request, with the
supervisory authority. The Controller shall be informed immediately
of any inspections and measures executed by the supervisory
authority, insofar as they relate to the activities under this DPA. This
also applies insofar as the Processor is under investigation or is party
to an investigation by a competent authority in connection with
infringements to any provision regarding the processing of personal
data in connection with the processing of this DPA. Insofar as the
Controller is subject to an inspection by the supervisory authority, an
 administrative fine, a preliminary injunction or criminal procedure, a
liability claim by a Data Subject or by a third party or any other claim
in connection with the processing of data by the Processor as of this
DPA, the Processor shall make every effort to support the Controller.

6. Sub-processors 

 (1) The Controller authorizes the Processor to outsource part of the processing
activities pursuant to this DPA to sub-processors. The sub-processors
shall, as legally required, be subject to the same contractual obligations resulting
from this agreement, pursuant to art. 28 par. 4 GDPR. 

[paragraph (2) is optional, only if sub-processors are already commissioned]

(2) At the date of signature of this agreement, the parties mutually acknowledge and
agree that the Processor currently commissions the following sub-processors on the
condition of a contractual agreement in accordance with Article 28 paragraph 4
GDPR:

A B C
1 Company Address/country Outsourced
sub- processing
processor activity
2      
3      

(3) It is understood between the parties that the communication of personal data to

any sub-processor shall only take place after all conditions set out in paragraph (1)
for the appointment of sub-processors have been met.
(4) The Processor must maintain and keep updated a list of sub-processors. The
Controller shall be notified of any change to such list without undue delay, giving the
Controller the option to object. In case of objection, the Processor retains the right to
terminate the contract in place with the Controller without notice. 
(5) The Processor shall bear full responsibility and liability for the activities of
its sub-processors vis a vis the Controller. 
(6) Should a sub-processor provide its services outside the EU/EEA, the Processor
shall ensure compliance with the rules regarding data transfer abroad, as
described under sec. 2 of this DPA. 

7. Audits

(1) The Controller has the right to carry out inspections or to have them carried out
by an auditor appointed on a case-by-case basis. The auditor shall assess the
Processor's compliance with this DPA in its business operations by means of
random checks, of which the Processor will be notified in advance.
(2) The Processor shall allow the Controller to verify compliance with its obligations
as provided by Article 28 GDPR. The Processor undertakes to give the Controller the
necessary information on request and, in particular, to demonstrate the
implementation of the technical and organisational measures.
 (3) Evidence of the implementation of such measures, which may not only concern
the activities under this DPA, may also be provided by
o compliance with approved Codes of Conduct pursuant to Article 40
GDPR;
o certification according to an approved certification procedure in
accordance with Article 42 GDPR;
o current auditor’s certificates, reports or excerpts from reports
provided by independent bodies (e.g. auditor, data protection officer,
IT security department, data protection auditor);
o a suitable certification by IT security or data protection auditing.
(4) The Processor may charge a reasonable fee to the Controller for enabling
inspections.

8. Assistance to the Controller

 (1) The Processor shall assist the Controller in complying with the obligations
concerning the security of personal data, reporting of data breaches, data protection
impact assessments and prior consultations set forth at Articles 32 to 36 of the
GDPR, including
 ensuring adequate protection standards through technical and
organisational measures, taking into account the type, circumstances and
purposes of processing, the likelihood of data breaches and the severity of
the risk to natural persons possibly resulting thereof
 ensuring immediate detection of infringements
 reporting data breaches without undue delay to the Controller
 assisting the Controller in answering to data subjects' requests for the
exercising of their rights
 (2) The Processor may charge the Controller a reasonable fee for support services
which are not included in the description of the services and which are not
attributable to the Processor's misconduct, mistakes or infringements. 

9. Directive powers of the Controller

 (1) The Processor shall not process any personal data under this DPA except on the
Controller's documented instructions, unless required to do so by Union or Member
State law.
(2) In case the Controller should require any change in the processing of personal
data set forth by the documented instructions mentioned at sec. 2, the Processor
shall immediately inform the Controller if it considers such changes likely to result
in infringements to data protection provisions. The Processor may refrain from
carrying out any activity that may result in any such infringement.
10. Liability

(1) Each party to this DPA commits to indemnify the other party for damages or
expenses resulting from its own culpable infringement of this DPA, including any
culpable infringement committed by its legal representative, subcontractors,
employees or any other agents. Furthermore, each party commits to indemnify the
other party against any claim exerted by third parties due to, or in connection with,
any culpable infringement by the respectively other party.
 (2) Art. 82 GDPR stays unaffected. 

11. Deletion and return of personal data

(1) The Processor shall not create copies or duplicates of the data without the
Controller's knowledge and consent, except for backup copies, insofar as they are
necessary for ensuring that data is processed correctly, and where the retention of
such data is required by law.
(2) After conclusion of the provision of services, the Processor shall, at the
Controller's choice, either delete in a data-protection compliant manner or return to
the Controller, all the personal data collected and processed under this DPA, unless
any applicable legal provision requires further storage of the personal data. 
(3) In any case, the Processor may retain beyond termination of the contract all
the information necessary to demonstrate the compliance of the processing
activities carried out. 
(4) The documentation referred to under point (3) above, shall be stored by the
Processor in accordance with the applicable retention periods, statutory or
otherwise determined. The Processor may hand the documentation over to the
Controller upon termination of the agreement. In such case, the Processor is
relieved from any obligation to keep such documentation.