Data Processing Agreement in United States: Template, Key Clauses and Local Law (2026)

Do you need a data processing agreement in the United States? Often, yes. If a business shares personal information with a vendor that processes it on the business's behalf, United States state privacy laws require a written contract with specific terms. Unlike Europe, the US has no single federal data protection law, so the obligation comes from a patchwork: California's CCPA and CPRA, and comprehensive privacy laws in Virginia, Colorado, Connecticut, Utah, and a growing number of other states, plus sector laws such as HIPAA for health data and GLBA for financial data. These laws use different labels (service provider, processor, business associate) for the same idea: the vendor may use the data only for the agreed purpose. This is general information, not legal advice. For data handling across several states or borders, ask a licensed US attorney. ## What US law requires in a DPA There is no one statute to point to, so match the DPA to the laws that apply to your data. ### State comprehensive privacy laws

California's CCPA, as amended by the CPRA, requires a contract when a business discloses personal information to a service provider or contractor. The contract must limit the vendor to processing for the specified business purpose, prohibit selling or sharing the data, prohibit combining it with other data, and require the same protections down the chain. Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, Utah's UCPA, and the newer state laws impose closely similar processor-contract requirements, generally tracking a controller and processor model. ### Sector laws HIPAA requires a Business Associate Agreement (BAA) when a covered entity shares protected health information. The Gramm-Leach-Bliley Act governs financial data. These sit alongside, not instead of, state law. ### Cross-border transfers If personal data also comes from the EU or UK, you may need Standard Contractual Clauses or the UK addendum layered on top; a US DPA alone does not cover an EU transfer. ## Key clauses in a US data processing agreement ### Roles and definitions State who is the business or controller and who is the service provider or processor, and define personal information consistently with the applicable state law. ### Scope, purpose, and instructions Describe the processing: the categories of data and data subjects, the purpose, and that the vendor processes only on the business's documented instructions. ### Purpose limitation and no sale The heart of a CCPA-compliant DPA: the vendor may not sell or share the data, may not keep or use it for its own purposes, and may not combine it with data from other sources, except as the law allows. ### Confidentiality and security Require confidentiality commitments from the vendor's staff and reasonable, documented security measures appropriate to the data. ### Subcontractors Require notice or consent for subprocessors and flow-down of equivalent terms, with the vendor staying responsible. ### Data subject and consumer rights Require the vendor to help the business respond to consumer requests to access, delete, or correct data within the law's deadlines. ### Breach notification Set a clear timeline for the vendor to notify the business of a security incident so the business can meet its own state breach-notice deadlines. ### Audits and compliance Give the business a right to verify the vendor's compliance, by assessment, certification, or audit. ### Return or deletion At the end of the contract, require the vendor to return or delete the data and certify it. ### Liability Allocate responsibility for a breach and align the DPA's liability with the main agreement. ## A simple US DPA skeleton 1. Parties and roles (business or controller; service provider or processor) 2. Definitions aligned to applicable law 3. Scope and details of processing (annex) 4. Processing only on instructions; purpose limitation; no sale or sharing 5. Confidentiality 6. Security measures (annex) 7. Subprocessors 8. Assistance with consumer and data subject rights 9. Breach notification 10. Audits and verification 11. Cross-border transfer terms if applicable (SCCs or UK addendum) 12. Return or deletion of data 13. Liability and indemnity 14. Term, order of precedence, and governing law ## Points worth negotiating Tighten the breach-notification window, because your own state deadlines depend on it. Make the no-sale and purpose-limitation language track the exact wording of the state law that applies, since CCPA has specific required terms. Nail down subprocessor notice and your right to object. Confirm, in writing, whether the vendor uses your data to train AI models. Align the DPA liability with the main contract so a data breach is not quietly carved out of the cap. ## Where a single contract workspace helps DPAs rarely travel alone: each one attaches to a main agreement, references a security annex, lists subprocessors, and carries a breach-notice window that must match your state obligations. Keeping all of that consistent across many vendors is the real work, and it is what an AI contract workspace is built for. Each agreement becomes a structured clause tree with positions marked favourable, neutral, or unfavourable to your company, and obligations and renewal dates surface automatically. Adira is one such workspace. Adira is India-first today, and deeper United States privacy coverage is on its roadmap, so for US-governed DPAs treat it as a drafting and tracking aid and confirm the exact state-law requirements with a US attorney. The clauses above do not change; a workspace just makes them easier to manage.