OptOutDeck
Menu

Data processing agreement template

Draft the contract you sign with a vendor that handles personal data for you: the GDPR Art. 28 processor terms, the CCPA service-provider or contractor terms, or both in one document. Fill in the parties and the processing, and the agreement writes itself clause by clause, each with the rule it answers. Print it or copy it for counsel. It runs in your browser and sends nothing.

Draft your DPA

Pre-filled with a realistic example: an Oregon outdoor-gear shop with buyers in the EU and California, signing with the email platform that sends its order mail and newsletter. Change any field and the draft below rewrites itself. Reset clears it for your own.

Laws to cover

Laws to cover

The vendor receives the data as a

Required terms drafted

21 of 21

Every required term has a clause with its blanks filled. A drafted term is not a reviewed contract: have counsel read it before anyone signs.

Required-term index: where each term sits in the draft

GDPR Art. 28

  • Art. 28(3)Subject-matter, duration, nature and purpose, data types, categories of data subjects, the controller's rights and dutiesclause 2
  • Art. 28(3)(a)Documented instructions only, transfers includedclause 3
  • Art. 28(3)(b)Confidentiality of everyone who handles the dataclause 5
  • Art. 28(3)(c)The security measures Art. 32 requiresclause 6
  • Art. 28(3)(d), 28(2)Sub-processors only with written authorisationclause 7
  • Art. 28(4)The same duties passed down to every sub-processorclause 7
  • Art. 28(3)(e)Help answering data subjects' requestsclause 8
  • Art. 28(3)(f)Help with security, breaches, DPIAs and prior consultation (Arts 32 to 36)clause 9
  • Art. 28(3)(g)Delete or return the data at the end, at the controller's choiceclause 10
  • Art. 28(3)(h)Information to show compliance; audits and inspectionsclause 11
  • Art. 28(3), second subparagraphTell the controller at once if an instruction breaks the lawclause 3

CCPA service provider and contractor terms

  • regs § 7051(a)(1)No selling or sharing of the personal informationclause 4
  • regs § 7051(a)(2); § 1798.100(d)(1)The specific business purposes, and disclosure only for themclause 2
  • regs § 7051(a)(3)No retaining, using or disclosing it for any other purposeclause 4
  • regs § 7051(a)(4)Nothing outside the direct business relationship; no combining with other dataclause 4
  • regs § 7051(a)(5); § 1798.100(d)(2)Comply with the CCPA and give the same level of privacy protectionclause 12
  • regs § 7051(a)(6); § 1798.100(d)(3)The business may take reasonable steps to check how the data is usedclause 11
  • regs § 7051(a)(7); § 1798.100(d)(4)Notice if the provider can no longer meet its obligationsclause 12
  • regs § 7051(a)(8); § 1798.100(d)(5)The business may stop and remediate unauthorized useclause 12
  • regs § 7051(a)(9)Help the business comply with consumer requestsclause 8
  • regs § 7051(b); § 1798.140(ag)(2), (j)(2)Notice of each subcontractor, bound by a written contractclause 7

Data Processing Agreement

Between Larkspur Trail Goods LLC, of Portland, Oregon, USA (“Customer”), and Kestrel Mail Inc., of Denver, Colorado, USA (“Provider”).

  1. 1.Definitions and roles

    “Customer Personal Data” means the personal data and personal information Provider processes for Customer under the Email Services Agreement (the “Main Agreement”). “Data Protection Law” means Regulation (EU) 2016/679 (the GDPR) and the California Consumer Privacy Act and its regulations (the CCPA).

    For the GDPR, Customer is the controller and Provider is the processor of the Customer Personal Data.

    For the CCPA, Customer is a business and Provider is its service provider, receiving the Customer Personal Data for the business purposes in clause 2.

    GDPR Art. 4(7), 4(8); CCPA § 1798.140(ag)(1)

  2. 2.Subject-matter, purposes and details

    Subject-matter: Sending Customer's transactional and marketing email. Duration: The term of the Main Agreement, then until the data is deleted or returned. Nature of the processing: Storing contact lists, sending email, recording delivery and open events, producing reports.

    Provider processes the Customer Personal Data only for these specific business purposes: Sending order confirmations, shipping notices and password resets to Customer's buyers; sending Customer's monthly newsletter to subscribers who opted in; reporting delivery, bounce and open rates to Customer. Customer discloses the Customer Personal Data to Provider only for these limited and specified purposes.

    The types of personal data and the categories of data subjects are listed in Schedule 1. Customer keeps the rights and obligations Data Protection Law gives a controller and a business.

    GDPR Art. 28(3); CCPA regs § 7051(a)(2); § 1798.100(d)(1)

  3. 3.Instructions

    Provider processes the Customer Personal Data only on Customer's documented instructions, including for any transfer to a third country or an international organisation. The Main Agreement and this Agreement are Customer's instructions; Customer may give further instructions in writing.

    If Union or Member State law to which Provider is subject requires other processing, Provider tells Customer of that requirement before processing, unless that law forbids it on important grounds of public interest. Provider tells Customer immediately if, in its opinion, an instruction infringes Data Protection Law.

    GDPR Art. 28(3)(a); Art. 28(3), second subparagraph

  4. 4.California restrictions

    Provider shall not:

    1. (a)sell or share the Customer Personal Data;
    2. (b)retain, use or disclose it for any purpose other than the business purposes in clause 2, including for a commercial purpose, unless the CCPA permits it;
    3. (c)retain, use or disclose it outside the direct business relationship between Provider and Customer;
    4. (d)combine it with personal information Provider receives from or on behalf of another person, or collects from its own interaction with the consumer, unless the CCPA permits it.

    The services do not include cross-context behavioral advertising.

    CCPA regs § 7051(a)(1), (3), (4); § 7050(b)

  5. 5.Confidentiality

    Provider ensures that every person it authorises to process the Customer Personal Data has committed to confidentiality or is under a statutory duty of confidentiality.

    GDPR Art. 28(3)(b)

  6. 6.Security

    Provider implements and keeps up the technical and organisational measures in Schedule 2, giving a level of security appropriate to the risk, and reasonable security procedures and practices appropriate to the nature of the personal information.

    GDPR Art. 28(3)(c); Art. 32; CCPA regs § 7051(a)(5); § 1798.81.5

  7. 7.Sub-processors

    Customer gives general written authorisation for the sub-processors in Schedule 3. Provider tells Customer in writing at least 30 days before it adds or replaces one, and Customer may object in that time.

    Provider binds each sub-processor by written contract to the same data protection obligations as this Agreement, and remains fully liable to Customer for the sub-processor's performance.

    Provider notifies Customer of each person it engages to help process the Customer Personal Data, under a written contract binding that person to the requirements of clause 4.

    GDPR Art. 28(2), 28(3)(d), 28(4); CCPA regs § 7051(b); § 1798.140(ag)(2)

  8. 8.Requests from individuals

    Taking into account the nature of the processing, Provider helps Customer, by appropriate technical and organisational measures where possible, to answer requests from people exercising their rights under Data Protection Law, and gives Customer the information it needs to do so.

    If a consumer sends a CCPA request to Provider directly, Provider either acts on it as Customer instructs or tells the consumer that the request cannot be acted on because it was sent to a service provider or contractor.

    GDPR Art. 28(3)(e); CCPA regs § 7051(a)(9); § 7050(c)

  9. 9.Breaches and assessments

    Provider notifies Customer of a personal data breach affecting the Customer Personal Data without undue delay, and in any event within 48 hours of becoming aware of it, with the information Customer needs to report it.

    Taking into account the nature of the processing and the information available to it, Provider helps Customer meet its duties on security, breach notification, data protection impact assessments and prior consultation.

    Provider cooperates with Customer's cybersecurity audits and risk assessments under the CCPA regulations, gives the facts in its possession they need, and does not misrepresent them.

    GDPR Art. 28(3)(f); Arts 32 to 36; Art. 33(2); CCPA regs § 7050(h); § 7051(a)(5)

  10. 10.End of the processing

    When the services end, Provider deletes or returns all Customer Personal Data, at Customer's choice, within 30 days, and deletes existing copies unless Union or Member State law requires them to be stored. On request Provider confirms the deletion in writing.

    GDPR Art. 28(3)(g)

  11. 11.Information and audits

    Provider makes available to Customer all information needed to show that it meets this Agreement, and allows for and contributes to audits, including inspections, by Customer or an auditor Customer appoints.

    Customer may take reasonable and appropriate steps to make sure Provider uses the Customer Personal Data consistently with Customer's CCPA obligations, including manual reviews, automated scans, and assessments, audits or other testing at least once every 12 months.

    GDPR Art. 28(3)(h); CCPA regs § 7051(a)(6); § 1798.100(d)(3)

  12. 12.California compliance and remediation

    Provider complies with the CCPA and its regulations as they apply to it, and gives the Customer Personal Data the same level of privacy protection the CCPA requires of Customer.

    Provider notifies Customer if it determines that it can no longer meet its obligations under the CCPA. On notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of the Customer Personal Data, including asking Provider for documentation that it no longer keeps or uses the data of consumers whose deletion requests Customer has passed on.

    CCPA regs § 7051(a)(5), (7), (8); § 1798.100(d)(2), (4), (5)

  13. 13.Transfers outside the EEA

    Provider transfers Customer Personal Data to a third country or an international organisation only on Customer's documented instructions and in line with Chapter V of the GDPR. The parties rely on the standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR, which the parties sign alongside this Agreement.

    GDPR Art. 28(3)(a); Chapter V (Arts 44 to 49)

  14. 14.Term, precedence and governing law

    This Agreement takes effect on 1 November 2026 and lasts as long as Provider processes Customer Personal Data. On data protection it prevails over the Main Agreement. It is made in writing, electronic form included, and is governed by the law of Ireland.

    GDPR Art. 28(9)

Schedule 1: Personal data and data subjects

Types of personal data

  • Email address
  • First name
  • Order number and items ordered
  • Email delivery, open and click events
  • IP address and device type recorded at open

Categories of data subjects

  • Customer's buyers
  • Newsletter subscribers

Schedule 2: Security measures

Measures

  • Encryption of personal data in transit (TLS 1.2 or higher) and at rest
  • Role-based access for staff, with multi-factor sign-in
  • Daily backups, with a restore tested every quarter
  • A yearly penetration test by an independent firm

Schedule 3: Authorised sub-processors

Sub-processors

  • Cloud hosting provider (servers in Frankfurt, Germany)
  • Email relay network (servers in the United States)

Signed for Customer

Signature

Name, title and date

Signed for Provider

Signature

Name, title and date

Drafted with the OptOutDeck DPA template. A starting draft for review by counsel; information, not legal advice.

Photocopy-style paste-up of two ruled contract pages with blank signature lines and a rubber stamp

What the contract must carry

Form of the contract
in writing, electronic form includedArt. 28(9)
Terms the GDPR names
eight, (a) to (h), plus the processing detailsArt. 28(3)
New sub-processor
prior specific or general written authorisationArt. 28(2)
Breach notice
vendor to you without undue delay, Art. 33(2); you to the regulator 72 hours where feasible, Art. 33(1)
EU model clauses
Decision (EU) 2021/915 of 4 June 2021Art. 28(7)
Terms California names
nineregs § 7051(a)(1)–(9)
Checking the vendor
may include testing at least once every 12 months§ 7051(a)(6)
Contract missing a term
not a service provider; the disclosure may be a sale or sharing§ 7050(e)

GDPR, Decision (EU) 2021/915, CCPA statute and regulations; read 22 Oct 2026. Information, not legal advice.

What is a data processing agreement?

A data processing agreement (DPA) is the contract between a business and a vendor that handles personal data for it, setting out what the vendor may do with that data and what it owes the business in return. Under the GDPR it is not optional: Art. 28(3) says processing by a processor “shall be governed by a contract”, and lists what the contract must say. California reaches the same place by definition: a vendor is only a “service provider” or “contractor” if a written contract carries the terms in § 1798.140 and regs § 7051(a).

Most vendors send their own DPA with the sign-up. This builder drafts one from your side, so you can either send it or hold the vendor’s version against it term by term. If you are not sure which of the two laws reaches you, the GDPR and CCPA side by side sets out who each one covers.

What it does not do

It runs in your browser: nothing you type is sent to us or stored, and closing the tab clears it. A drafted term is not a reviewed contract, and no template knows your processing. Information, not legal advice; have counsel read the draft before anyone signs.

One clause, two laws: the crosswalk

The two rule texts were written apart but ask for many of the same promises. The draft carries each promise once and cites both laws beside it, so a single contract serves a vendor that holds EU and Californian data. Here is where each clause comes from, with both modules on and the vendor set as a contractor.

Each clause of the draft with the GDPR and CCPA rules it answers
ClauseGDPRCCPA
1. Definitions and rolesArt. 4(7), 4(8)§ 1798.140(j)(1)
2. Subject-matter, purposes and detailsArt. 28(3)regs § 7051(a)(2); § 1798.100(d)(1)
3. InstructionsArt. 28(3)(a); Art. 28(3), second subparagraphno separate term
4. California restrictionsno separate termregs § 7051(a)(1), (3), (4); § 7050(b); § 1798.140(j)(1)(B)
5. ConfidentialityArt. 28(3)(b)no separate term
6. SecurityArt. 28(3)(c); Art. 32regs § 7051(a)(5); § 1798.81.5
7. Sub-processorsArt. 28(2), 28(3)(d), 28(4)regs § 7051(b); § 1798.140(ag)(2)
8. Requests from individualsArt. 28(3)(e)regs § 7051(a)(9); § 7050(c)
9. Breaches and assessmentsArt. 28(3)(f); Arts 32 to 36; Art. 33(2)regs § 7050(h); § 7051(a)(5)
10. End of the processingArt. 28(3)(g)no separate term
11. Information and auditsArt. 28(3)(h)regs § 7051(a)(6); § 1798.100(d)(3)
12. California compliance and remediationno separate termregs § 7051(a)(5), (7), (8); § 1798.100(d)(2), (4), (5)
13. Transfers outside the EEAArt. 28(3)(a); Chapter V (Arts 44 to 49)no separate term
14. Term, precedence and governing lawArt. 28(9)no separate term
Rule texts: GDPR Art. 28, 32 to 36 and Chapter V; Civ. Code §§ 1798.100(d), 1798.140; CCPA regs §§ 7050, 7051. read 22 Oct 2026.

The draft tracks 22 required terms in all. Some rows carry one law only, on purpose: the GDPR’s confidentiality, instruction and transfer terms have no separate line in § 7051, and the CCPA’s ban on selling, sharing and combining has no single GDPR twin, because Art. 28(10) treats a processor that sets its own purposes as a controller instead.

How to use the template

  1. Switch on the laws that reach the data this vendor will hold. Pick “contractor” when the vendor is not processing on your behalf but receives the data for a business purpose; it adds a certification clause.
  2. Fill the three tabs. Each tab counts its blanks; a blank shows in the draft as a bracketed gap, so nothing goes out looking finished when it is not.
  3. Write the business purposes the way you would brief a new hire: each job, by name. The builder flags wording that points at the whole contract.
  4. Open the required-term index. Every term shows the clause that carries it, or what is still open.
  5. Print the draft (the form is left off the page) or copy it as text into your own document, then send it to counsel and to the vendor.

Keep the list of vendors and what each one holds in a data map; the DPA’s Schedule 1 is that map’s row for one vendor.

Worked example: the gear shop and its email platform

The builder opens on a 30-person outdoor-gear shop in Oregon that sells to buyers in the EU and California, signing with the US email platform that sends its order mail and monthly newsletter. Both modules are on and the platform is a service provider. The first draft the platform offered named its purpose in one line; the builder flags that line, and the shop replaced it with the three jobs the platform actually does.

The example's key entries and what the builder does with them
FieldExample entryWhat the builder does
Purposes, first tryTo provide the Services under the AgreementFlags it: the purposes read as generic; § 7051(a)(2) wants them specific.
Purposes, finalSending order confirmations, shipping notices and password resets to Customer's buyers; sending Customer's monthly newsletter to subscribers who opted in; reporting delivery, bounce and open rates to CustomerPasses the check and goes into clause 2 word for word.
Breach notice to the shop48 hoursLeaves the shop a day of its own 72-hour clock to the regulator (Art. 33(1)).
New sub-processorgeneral authorisation, 30 days' noticeGives the shop time to object before the change, as Art. 28(2) requires.
End of the servicedelete or return within 30 daysKeeps the choice with the shop, per Art. 28(3)(g), with written confirmation.
Data outside the EEAyes; the Commission's clausesAdds a transfer clause tied to GDPR Chapter V.
Example entries as pre-filled; fictional companies. Rule texts read 22 Oct 2026. Information, not legal advice.

Where vendor DPAs fall short

The usual gaps are not missing clauses but clauses that say less than the rule asks for.

Purposes that point at the whole contract

“To provide the Services” is a familiar purpose line in vendor DPAs, and California’s regulations rule it out: the business purposes “shall not be described in generic terms, such as referencing the entire contract generally.” Name each job instead.

An ad partner papered as a service provider

A vendor hired for cross-context behavioral advertising is a third party, never a service provider, whatever the contract calls it (regs § 7050(b)). And a vendor whose contract lacks the § 7051(a) terms is not a service provider either, so handing it data “may be considered a sale or sharing” (§ 7050(e)), with the opt-out duties that follow; the Do Not Sell or Share link guide covers those. In the American Honda Motor Co. settlement the CPPA announced on 12 March 2025, one of the claims was sharing personal information with ad tech companies without contracts containing the necessary terms; Honda agreed to change its contracting process and pay a $632,500 fine.

A sub-processor list with no notice window

Art. 28(2) lets you give general authorisation only if the vendor tells you of changes and you get the chance to object. A list on a web page with no promised notice gives you neither. Even the Commission’s own clauses leave the period blank for the parties to fill; this builder makes it a number.

A breach clause that uses up your 72 hours

The vendor owes you notice “without undue delay” (Art. 33(2)); you owe the regulator notice within 72 hours where feasible (Art. 33(1)). A vendor clause of 72 hours spends your whole window before you know anything. Set a number that leaves you time to assess.

Signed, filed, never checked

California counts what you do after signing: a business that never enforces the contract or uses its audit rights “might not be able to rely on the defense” that it had no reason to believe the vendor was misusing data (§ 7051(c)). Put the vendor review on the calendar; the CCPA compliance checklist carries it as a duty with an owner.

Jurisdiction notes

EUUKCAVA

European Union

Art. 28 binds every controller that uses a processor, inside the EU or caught from outside it (see whether the GDPR applies to a US company). The Commission’s Decision (EU) 2021/915 of 4 June 2021 publishes model clauses that, in its own words, “fulfil the requirements” of Art. 28(3) and (4); parties may use them instead of their own text.

United Kingdom

The UK GDPR keeps Art. 28 with the same (a) to (h) list; where the EU text says Union or Member State law, the UK text says domestic law. The EU module’s clauses read across, with “Union or Member State law” changed to UK law.

California

The California module follows Civ. Code §§ 1798.100(d) and 1798.140(ag) and (j), and regs § 7051, in the regulations headed effective 1 January 2026. The terms only matter if the CCPA reaches the business; the CCPA guide sets out the three tests.

Virginia and the other states

Va. Code § 59.1-579(B) asks for a processor contract that sets out instructions, the nature and purpose of processing, the type of data, the duration and both parties’ rights and obligations, and binds the processor to confidentiality, deletion or return at the end, information on request, reasonable assessments (or an independent assessor’s report) and written contracts with subcontractors. The EU module covers that list closely; read the Virginia guide for the rest of the law. Other states have their own processor sections; our state privacy law tracker lists the laws in force.

Check this

Turning on a module adds clauses; it does not decide whether the law applies to you or whether the draft fits your processing. Information, not legal advice.

Questions

Is a DPA the same as the EU standard contractual clauses?

No, though they overlap. The Commission’s 2021 clauses under Art. 28(7) are one ready-made way to write a DPA. Moving data out of the EEA is a separate question under Chapter V of the GDPR, answered by an adequacy decision, the Commission’s transfer clauses under Art. 46(2)(c) or another Art. 46 tool. The transfer clause in this draft names which one you rely on.

Can we sign the vendor's DPA instead of ours?

Yes, and with large vendors you usually will. Hold their text against the required-term index here: each term should have a clause, and the purposes should be specific enough to pass California’s test. Where a term is missing, ask for an addendum. An AI tool your staff use is a vendor too: the GDPR and AI tools guide covers its processor terms and training opt-outs.

Do we need a DPA with a vendor that only stores our data?

Under the GDPR, yes: Art. 4(2) lists storage as processing, so a hosting or backup provider holding personal data for you is a processor. The same contract duties apply.

Service provider or contractor: which is our vendor?

A service provider processes personal information on your behalf, such as an email platform or payroll bureau (§ 1798.140(ag)). A contractor is someone you make the data available to for a business purpose (§ 1798.140(j)). The contract terms are almost the same; a contractor must also certify that it understands and will follow the restrictions.

Does the CCPA require a yearly audit of every vendor?

No. The contract must give you the right to take reasonable and appropriate steps to check the vendor’s use of the data; regs § 7051(a)(6) says those steps may include testing at least once every 12 months. How often you actually check is your call, and § 7051(c) counts it.

Does a signed DPA make us compliant?

No. A DPA is one duty among many, and a contract that carries every required term can still sit beside processing it does not describe. Treat the draft as the starting point for counsel and the vendor, and a privacy impact assessment as the place to weigh the risk of the processing itself.

Related