Template
Data Processing Agreement Template (GDPR Article 28)
This template defines the structure of a data processing agreement (DPA) sufficient to satisfy the controller-to-processor contract that GDPR Article 28(3) requires whenever a controller engages a processor to process personal data on its behalf. It collects, into one populatable instrument, the eight mandatory processor obligations of Article 28(3)(a) to (h) plus the sub-processor conditions of Article 28(2) and (4) and the written-form requirement of Article 28(9). It also accommodates the equivalent processor-contract obligation under UK GDPR Article 28 and the analogous operator or processor obligations under LGPD (Brazil), PIPL (China), and PIPEDA (Canada, accountability for transfers to third parties for processing).
- Type
- Template
- Version
- 1.0.4
- Date
- 2026-09-07
- Owner
- Data Protection Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Privacy
- Review frequency
- Annual and upon material change to the processing arrangement, the sub-processor chain, or the applicable privacy regime
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Field set
- Use guidance
- Framework alignment
- Limitations
Frameworks it maps to
- GDPR
- EU Commission SCCs
- UK GDPR
- LGPD (Brazil)
- PIPL (China)
- PIPEDA (Canada)
- ISO/IEC 27001:2022
- ISO/IEC 27701:2025
- CSA CCM v4.1
- NIST CSF 2.0
Related documents
- Privacy and Data Governance Policyprivacy
- Record of Processing Activities Templateprivacy
- Joint Controller Arrangement Templateprivacy
- Data Subject Rights Management Procedureprivacy
- Data Protection and Privacy Breach Response Procedureprivacy
- Privacy Impact and Cross-Border Transfer Procedureprivacy
- Subprocessor Register Templatesupply-chain
- Supplier Security and Privacy Assurance Standardsupply-chain
- Data Retention Schedulegovernance
Next
All Documents