What is a Data Processing Agreement?

Having it in writing gives data controllers and their service providers a single reference point if expectations later diverge — which is precisely when memories of what was agreed stop matching.

There are 18 fields here, grouped into 6 areas — parties and contact details, scope and deliverables, payment and financial terms, dates, timing and duration, confidentiality and intellectual property, and legal protections and risk. Each is a term that causes argument when left unstated, which is why the generator asks for it rather than leaving a gap in the document.

Where these agreements go wrong, it is usually a sub-processor engaged without the controller ever being told rather than a defect in the boilerplate. Business agreements tend to fail at the edges — deadlock between owners, automatic renewals nobody diarised, and liability caps that turn out to sit above the value of the contract.

The preview updates live as you complete each field, so you can review the exact language before downloading it as PDF or Word. Treat the result as a well-organised first draft: sound in structure, but worth an attorney's review where the sums involved are significant or the situation is unusual.

What matters most in a data processing agreement

Breach notification timing

Processors must notify the controller without undue delay. Agree a specific timeframe — 24 to 72 hours is common.

It is usually mandatory, not optional

Privacy laws including the GDPR require a written contract with specific mandatory terms whenever a processor handles personal data for a controller.

Specify the processing

Set out the subject matter, duration, nature and purpose of processing, the categories of data and of data subjects. Generic wording does not satisfy the requirement.

When you need a data processing agreement

  • When you already have the schedule describing the data and its purpose: If there is a brief, plan, specification or schedule, attach it. An agreement that refers to a record nobody has attached is only half a record.
  • When either side may need an exit: Agree how the arrangement ends while both parties are still on good terms. Exit clauses negotiated during a dispute rarely favour anyone.
  • When a sub-processor engaged without the controller ever being told is a realistic prospect: If this is the way the arrangement usually goes wrong, it belongs in the document. Allocating that risk in advance is much cheaper than allocating it afterwards.
  • When someone else is paying: Where a third party funds or guarantees the arrangement, they should be named and their obligations spelled out. A guarantee that is only implied is not a guarantee.
  • When deletion or return of the data and proof that it happened has value: Where something is still owed after the end of the processing, that obligation needs its own words. Anything expected to survive the end of the agreement has to say so.
  • When the arrangement will repeat: For a relationship that runs across several jobs or periods, agree the standing terms once and let each instance sit under them rather than renegotiating from scratch.

What to include in a data processing agreement

This generator collects 18 details. Here is what each group covers and why it matters when the document is relied on.

Parties and contact details

Get these right before anything else. A dispute over the personal data is unwinnable if the document names a party that does not legally exist.

Company Name
The company's registered legal name, including its corporate suffix such as LLC, Inc or Ltd.
Company Address
The company's registered office or principal place of business.
Counterparty Name
The full legal name of the other party entering into this agreement.
Counterparty Address
The counterparty's address for formal notices.

Scope and deliverables

The description of the personal data is what turns an extra request into a chargeable variation. Write it so that someone outside the arrangement could tell what is in and what is out.

Purpose of Agreement
Why the parties are entering into the agreement. This helps a court interpret ambiguous clauses in line with the parties' actual intent.
Products or Services
The goods or services supplied, identified by specification, model or catalogue reference.
Performance Standards
The measurable standard the work must meet — response times, quality levels or service metrics.

Payment and financial terms

Write key figures out in full and name the currency. Where the price depends on a count of processing activities, record that count as you go rather than reconstructing it at invoice time.

Commercial Terms
The core business terms — volumes, discounts, rebates, minimum commitments and review points.
Pricing
The unit prices or rate card, plus how and when prices may be revised.
Payment Terms
The invoicing cycle, payment window, accepted methods and consequences of non-payment.
Limitation of Liability
The cap on each party's financial exposure. Note that liability for fraud, death or personal injury generally cannot be excluded.

Dates, timing and duration

Use calendar dates, not relative triggers. "On approval" cannot be located on a calendar, which means it cannot be used to show that anyone is late.

Effective Date
The date the agreement takes effect. This can differ from the signature date, and it is the date obligations start running from.
Delivery Timeline
Lead times and delivery windows, plus what counts as a late delivery and the remedy for it.

Confidentiality and intellectual property

State the territory, media, term and exclusivity of anything licensed. An unbounded licence is a transfer that was priced as a licence.

Confidentiality Obligations
The duty to keep information private, who it may be shared with internally, and the standard of care required.
Intellectual Property Rights
Who owns the IP created under the agreement, and what licence the other party receives.

Legal protections and risk

These are the clauses nobody reads until something goes wrong, at which point they are the only clauses that matter.

Warranties
The promises each party makes about quality, title and authority, and how long they last.
Termination Rights
The circumstances in which each party may end the agreement, distinguishing termination for convenience from termination for breach.
Governing Law
The legal system that applies and the courts that will hear any dispute.

Completing this data processing agreement

Recording where this applies

If the parties are in different states, name which state's law applies and where any dispute would be heard. Adding one line now avoids a preliminary argument later.

Naming the processor and the controller properly

Use full legal names — the registered entity, not a trading name. These are the names that must match if the document is ever relied on in a dispute or filed with a registry.

Attaching the schedule describing the data and its purpose

The schedule describing the data and its purpose carries most of the evidential weight here. Attach it as a schedule and refer to it by name in the body, rather than leaving it as an email nobody can find later.

Defining the end of the processing

Say what has to be true for the end of the processing to have happened and who confirms it. An undefined completion test is the reason obligations sit open long after the work is finished.

Making the counts checkable

Where the price depends on processing activities, keep a contemporaneous record as they are delivered. A count reconstructed at invoice time invites a challenge that a running record would have prevented.

Common mistakes to avoid

  1. Pricing without a unit. Quote against a defined number of processing activities. Where the price is a single figure covering an undefined quantity, every additional request looks free to the controller and unpaid to the processor.
  2. Overlooking third-party consents. Where a landlord, lender, insurer or regulator has to agree, get that consent before the end of the processing rather than assuming it will follow.
  3. Assuming the other side has authority. Check that whoever signs can bind their organisation. A signature from someone without authority is a defence waiting to be raised.
  4. Deposits with no agreed status. Say whether a deposit is refundable, what it secures, and what happens to it if the arrangement ends early. Deposit disputes are among the most common of all.
  5. Nobody keeps a signed copy. Each party should hold a fully signed version. A contract that exists only as an unsigned draft on one side's laptop is very hard to rely on.

How to use this data processing agreement generator

  1. Fill in the form. Enter the 18 details requested. Where an entry depends on a count — processing activities, dates, amounts — put the number in rather than a description of it. Nothing is sent to a server — the document is assembled in your browser.
  2. Read the preview. Scan the preview for anything left blank or approximate. Dates, amounts and the description of the personal data are the entries that get tested.
  3. Download and sign. Download in either format and circulate for signature. Diarise the dates the document creates, particularly anything that has to happen before the end of the processing.

Data Processing Agreement — frequently asked questions

When is a data processing agreement legally required?

Whenever one organisation processes personal data on behalf of another — using a payroll bureau, a cloud CRM, an email platform or an outsourced support team. Under the GDPR and comparable laws the contract must include specific mandatory terms, and the controller can face enforcement action for allowing processing to happen without one in place.

Who should sign the data processing agreement?

The processor and the controller, through someone with authority to bind them. Where either is a company, that means a director or an officer with delegated authority — a signature from someone without it is a defence waiting to be raised.

What records should I keep alongside the data processing agreement?

The schedule describing the data and its purpose, the signed document itself, and a contemporaneous note of anything agreed afterwards. Most disputes turn on what was agreed at the time, and the party who can produce a dated record is the party who wins that argument.

Which state's law should govern this data processing agreement?

Choose a state with a genuine connection to the parties or the subject matter — where a party is based, or where the work or property is located. A choice with no connection at all may not be respected, and for property or employment the local state's rules will often apply regardless of what the contract says.

Who owns the work produced under this agreement?

Whoever the agreement says owns it — and if it says nothing, the creator generally does. Paying for work does not transfer copyright by itself. If ownership is meant to pass to the client, the assignment clause needs to say so expressly, and it is common to make the transfer conditional on payment in full.

How long do the confidentiality obligations last?

Ordinary commercial information is usually protected for a fixed period of two to five years after the agreement ends, while genuine trade secrets are often protected for as long as they stay secret. Whichever you choose, state expressly that the confidentiality clause survives termination — otherwise the protection ends with the contract.

Can liability be limited to any amount?

Within limits. Parties can cap ordinary commercial liability, and a cap set against contract value or insurance cover is normal. But liability for fraud, death and personal injury generally cannot be excluded, and a cap so low it makes the obligations meaningless may be struck down as unreasonable.

Does a business contract need to be signed by a director?

It needs to be signed by someone with authority to bind the entity. For a company that is typically a director or an officer with delegated authority; for an LLC, a manager or authorised member. If you are unsure, ask for evidence of authority before relying on the signature.