Data Processing Addendum (DPA): Template and Key Terms (2026)

A data processing addendum (DPA), sometimes called a data processing agreement, is the contract that governs how one company handles personal data on behalf of another. If you use a vendor that stores or processes your customers' or employees' personal data, a payroll provider, a cloud host, an email tool, an analytics service, data protection law usually requires a written DPA between you. It is not optional boilerplate. In the European Union it is a legal requirement, and similar rules now apply in the United Kingdom, India, and many other places. This is general information, not legal advice. Data protection law differs by jurisdiction and changes often, so confirm the current requirements for your region before relying on a template. ## Controller and processor: the roles that drive everything A DPA only makes sense once you know who is who. The controller decides why and how personal data is processed; it is usually the business that collects the data. The processor processes the data on the controller's instructions; it is usually the vendor. A DPA is the contract between a controller and a processor. Sometimes two companies are joint controllers, which needs a different kind of arrangement. Under the GDPR, Article 28 requires that whenever a controller uses a processor, there must be a contract with specific mandatory terms. That is the DPA. The UK GDPR carries the same requirement. India's Digital Personal Data Protection Act places obligations on data fiduciaries and their processors along similar lines, and US state laws such as the California privacy rules also require contracts with service providers. ## The clauses a DPA must contain Under the GDPR and equivalent laws, a compliant DPA has to cover, as a minimum: - Subject matter and duration of the processing.

• Nature and purpose of the processing, and the types of personal data and categories of data subjects involved. This usually sits in an annex.
• Processing only on documented instructions from the controller.
• Confidentiality: everyone handling the data is bound to keep it confidential.
• Security measures: appropriate technical and organisational measures to protect the data.
• Sub-processors: the processor may only engage sub-processors with the controller's authorisation and must flow down the same obligations.
• Assistance to the controller in responding to data subject requests and in meeting its own security, breach, and impact-assessment duties.
• Breach notification: the processor tells the controller about a personal data breach without undue delay.
• Deletion or return of the data at the end of the service.
• Audits: the processor makes available the information needed to show compliance and allows audits.
• International transfers: a lawful mechanism, such as the EU Standard Contractual Clauses or the UK addendum, if data leaves the region. ## A DPA skeleton you can adapt > Data Processing Addendum

This DPA forms part of the [Main Agreement] between [Controller] and [Processor], effective [date].

1. Definitions. Terms such as personal data, processing, controller, processor, and data subject have the meaning given in [applicable law].
2. Scope and roles. The Processor processes personal data only to provide the services and only on the Controller's documented instructions.
3. Details of processing. Set out in Annex 1 (subject matter, duration, nature, purpose, data types, data subjects).
4. Confidentiality. Personnel are bound by confidentiality.
5. Security. The Processor applies the technical and organisational measures in Annex 2.
6. Sub-processors. Listed in Annex 3; new ones require [prior authorisation / notice and objection rights]; same terms flow down.
7. Assistance and data subject rights. The Processor assists the Controller with requests and legal duties.
8. Breach notification. The Processor notifies the Controller without undue delay after becoming aware of a breach.
9. Deletion or return. On termination, the Processor deletes or returns the data as the Controller chooses.
10. Audit. The Processor provides information and allows audits to demonstrate compliance.
11. International transfers. Any transfer outside [region] uses an approved mechanism set out in Annex 4.
12. Governing law. [Jurisdiction]. ## Common mistakes to avoid - Having no DPA at all with a vendor that clearly processes personal data for you, which is a direct compliance gap.

• Leaving the annexes blank, so the mandatory detail about what data and why is missing.
• Accepting a vendor's standard DPA without checking it names a lawful transfer mechanism for data that leaves the region.
• Allowing unlimited sub-processors with no notice or objection right.
• Ignoring breach notification timing, which is strict under most laws.
• Forgetting that if you are the processor for your own customers, you may need DPAs in both directions. ## Keeping DPAs matched to every vendor Most companies cannot quickly say which vendors have a signed DPA, which transfer mechanism each uses, or which sub-processors were approved. That gap is exactly what a regulator or a customer audit exposes. Keeping every DPA, its annexes, and its sub-processor list in one place, linked to the vendor contract, makes compliance provable rather than hopeful. Adira is an AI contract workspace that drafts, reviews, and tracks addenda like DPAs and their annexes in one place, and flags missing or inconsistent terms. More at its product page. The skeleton and guidance above stand on their own. ## Bottom line A data processing addendum is the mandatory contract between a controller and a processor that sets out how personal data will be handled. Under the GDPR, UK GDPR, India's DPDP Act, and US state privacy laws, it must cover the processing details, security, confidentiality, sub-processors, breach notification, data subject assistance, deletion, audit, and lawful international transfers. Fill in the annexes, check the transfer mechanism, and keep it matched to the main contract. Because data protection law changes quickly, confirm the current requirements with a qualified adviser before relying on a template.