Are electronic DPAs legally enforceable?

Yes. In the United States electronic signatures are generally binding under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure intent, consent, attribution, and retention are documented.

Do I need a BAA for HIPAA-covered data?

Yes. If the processor will handle protected health information, a Business Associate Agreement is required and HIPAA safeguards must be implemented and documented.

When is notarization required for a DPA?

Notarization is not typically required for DPAs, but state or counterparty practices may demand notarized signatures for certain related instruments; verify state rules and contract terms.

How should I handle requests to revoke consent?

Include a withdrawal procedure that explains effects of revocation, timelines for ceasing processing, and data return or deletion steps consistent with ESIGN consumer-disclosure obligations.

Can I update a signed DPA later?

Yes, but amendments should be executed by authorized signatories via a signed amendment or replacement agreement; document effective dates and retention of previous versions.

What if a party discovers incorrect data handling?

Follow the contract’s breach procedures: notify affected parties, remediate deficiencies, preserve logs for audits, and cooperate with regulatory investigations as required.

Electronic Signature
Templates
Miscellaneous
Business Data Processing Agreement

Business Data Processing Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS DATA PROCESSING AGREEMENT

This Business Data Processing Agreement ("Agreement") is made effective as of by and between:

Data Controller: Data Processor:

RECITALS

WHEREAS, the Data Controller, identified above, determines the purposes and means of processing certain personal data for its business operations; and

WHEREAS, the Data Processor, identified above, provides services that require access to and processing of such personal data on behalf of the Controller and agrees to process such data only in accordance with this Agreement and documented instructions from the Controller; and

WHEREAS, the parties wish to set out their respective obligations with respect to confidentiality, security, breach notification, return and deletion of personal data, and related matters.

SCOPE OF WORK

The Processor shall process personal data only to perform the services described below, in accordance with the Controller's documented instructions and the terms of this Agreement.

Description of Processing Activities and Services: Purpose of Processing:

DATA ITEMS AND CATEGORIES

Categories of data subjects:

Types of personal data processed:

SECURITY AND CONFIDENTIALITY

The Processor shall implement and maintain appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access in accordance with industry standards. Such measures shall include, at minimum, the measures described below and any additional measures reasonably required by the Controller.

Security Measures (describe controls, encryption, access restrictions, logging):

The Processor and its personnel shall keep all personal data confidential and shall not disclose it to any third party except as authorized by the Controller or as required by law, in which case the Processor shall provide prior notice to the Controller to the extent permitted.

SUBPROCESSING

The Processor shall not engage any subcontractor to process personal data without prior written authorization from the Controller. The Controller authorizes the use of subprocessors as indicated below:

Authorization to use subprocessors: Controller expressly authorizes Processor to engage subprocessors

List of current subprocessors (if any):

DATA SUBJECT RIGHTS AND ASSISTANCE

The Processor shall, taking into account the nature of the processing, assist the Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests from data subjects exercising their rights.

BREACH NOTIFICATION

The Processor shall notify the Controller without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach. The notice shall describe the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed to address the breach.

RETURN OR DELETION OF PERSONAL DATA

Upon termination or expiration of this Agreement, the Processor shall, at the Controller's choice, return all personal data to the Controller and delete existing copies unless applicable law requires storage of the personal data. The Processor shall certify in writing that it has complied with this obligation.

AUDIT AND INSPECTION

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this Agreement and allow for and contribute to audits and inspections conducted by the Controller or an authorized auditor on reasonable notice.

PAYMENT TERMS

In consideration for processing services, the Controller agrees to pay the Processor the fees set forth below. Fees payable under this Agreement are exclusive of any applicable taxes unless otherwise stated.

Processing Fee Amount: Payment Schedule: Late Fee / Interest on Overdue Amounts:

TERM AND TERMINATION

This Agreement commences on and continues until unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement for material breach by the other party if the breach remains uncured 30 days after written notice, or immediately upon insolvency of the other party.

Termination Notice Period (days):

LIABILITY AND INDEMNITY

Each party's aggregate liability under this Agreement for direct damages arising from a breach of this Agreement shall be limited to the amounts paid by the Controller to the Processor under this Agreement in the 12 months preceding the event giving rise to liability, except that such limitation shall not apply to liability resulting from willful misconduct, gross negligence, or breach of confidentiality or data protection obligations.

The Processor shall indemnify and hold harmless the Controller from any third-party claims arising from Processor's unauthorized processing or breach of its obligations under this Agreement to the extent caused by Processor's acts or omissions.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of without regard to its conflicts of law principles.

ENTIRE AGREEMENT

This Agreement, together with any exhibits and statements of work referenced herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, or representations, written or oral.

MISCELLANEOUS

No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both parties. If any provision of this Agreement is held invalid or unenforceable, the remainder of the Agreement shall remain in full force and effect.

Controller Primary Contact for Data Processing Matters: Processor Primary Contact for Data Processing Matters:

CERTIFICATION

Each party represents and warrants that it has the full corporate power and authority to enter into this Agreement, that the signatory below is authorized to execute this Agreement on behalf of such party, and that the performance of this Agreement will not violate any other agreement.

Controller Printed Name:

By:

Date:

Processor Printed Name:

By:

Date:

What a Business Data Processing Agreement Is and Why It Matters

A Business Data Processing Agreement (DPA) is a contractual document that defines how a data controller and a data processor manage personal and business data. It sets the permitted purposes, categories of data processed, security measures, subprocessor rules, breach notification obligations, and deletion or return procedures. In the United States a DPA helps organizations meet contractual and regulatory obligations, supports HIPAA or sector-specific controls where required, and clarifies liability, indemnity, and audit rights between parties.

Why a DPA Is Important for Compliance and Risk Management

A DPA reduces legal and operational risk by specifying obligations for data handling, security controls, breach response, and audit access. It documents responsibilities, demonstrates due diligence for regulators and customers, and can be required when handling protected health information or regulated financial data.

Which Teams and Organizations Typically Use a DPA

Organizations exchanging personal, customer, or regulated data rely on DPAs to formalize processing responsibilities and protect sensitive information.

Data controllers and processors in healthcare, finance, and SaaS who must allocate compliance duties and document safeguards.
Legal, procurement, and vendor management teams negotiating vendor contracts where data handling, breach processes, and liability need clarity.
IT and security teams that require defined responsibilities for access controls, encryption, logging, and subprocessor oversight.

Small businesses through large enterprises use DPAs when onboarding vendors, integrating cloud services, or sharing data with third parties; the agreement creates an auditable record of protections.

Core Sections Every Business Data Processing Agreement Should Include

A professional DPA organizes obligations clearly so both parties understand permitted uses, technical safeguards, and legal remedies. Include these six essential elements.

Scope

Defines which data categories, processing activities, and specific services are covered; limits processing to stated purposes to reduce legal exposure and scope creep.

Data Categories

Lists personal data types processed (names, emails, financial records, health data) and any special categories such as PHI, clarifying data subject cohorts and retention triggers.

Security Measures

Specifies technical and organizational controls such as encryption, access controls, logging, vulnerability testing, and incident response to demonstrate reasonable safeguards.

Subprocessors

Describes rules for hiring subprocessors, notification or approval mechanisms, and the processor’s obligation to flow down equivalent protections to subcontractors.

Breach Notification

Commitments on detection, notification timelines, required content of notices, and cooperation for regulatory or affected-party communications following an incident.

Audit and Termination

Rights to audits or attestations, data return or deletion procedures on termination, and liabilities, indemnities, and limitations that govern post-contract obligations.

Step-by-Step: Completing a Business Data Processing Agreement

Follow these sequential steps to prepare, negotiate, execute, and onboard under a DPA.

01

Prepare: Gather vendor details and data scope specifications.
02

Negotiate: Adjust security and liability clauses with legal counsel.
03

Execute: Obtain authorized signatures and date the document.
04

Onboard: Confirm controls, subprocessors, and operational procedures.

How to Set Up an Online DPA Workflow

Configure digital fields, authentication, and record retention to match contract terms and compliance obligations.

Field	Configuration
Signature Field Setup	Place signer name, signature, and date fields with required flags.
Authentication	Select email link, SMS code, or stronger KBA based on risk.
Conditional Fields	Enable conditional visibility for PHI clauses or optional addenda.
Retention Setting	Configure automatic archive or deletion to match retention rules.

Typical Routing and Submission Flow for a DPA

A standard electronic workflow moves the agreement from drafter to counterparty, captures authentication, and stores the executed record with an audit trail.

Upload: Sender uploads DPA and adds fields.
Assign Signers: Specify signer order and roles.
Authenticate: Signers verify via agreed method.
Store: Signed copy and audit trail are archived.

Technical and Integration Considerations for eSigning a DPA

Ensure the eSignature platform supports required authentication, retention, and compliance features before executing a DPA.

Authentication Options: Email, SMS, KBA, or stronger.
Integrations: CRM and cloud storage supported.
Data Formats: PDF, DOCX, and audit logs.

Choose platform capabilities that match audit, BAA, and 21 CFR Part 11 requirements if your industry demands additional validation or cryptographic signatures; integrate with existing systems for automated recordkeeping.

Typical Deadlines and Response Expectations in a DPA

DPAs often set specific operational deadlines for access requests, breach notifications, and audit responses to ensure timely compliance and coordination.

Breach Notification:

HIPAA-covered entities follow 45 CFR §164.404 timing; notify without unreasonable delay, no later than 60 days for larger breaches.

Access Requests:

Processors should respond within contract windows, commonly 15–30 calendar days.

Audit Responses:

Vendors typically provide records or attestations within 10–30 business days.

Subprocessor Notice:

Require advance notice of intended subprocessors, commonly 10–30 days before engagement.

Data Deletion:

Specify timeline for deletion or return after termination, often 30–90 days.

Key Milestones from Negotiation to Ongoing Compliance

These sequential milestones outline the typical lifecycle events and checkpoints for a DPA.

01

Negotiation

Agree scope, security controls, and liability allocations before signing.

02

Execution

Obtain authorized signatures and record the effective date.

03

Onboarding

Implement controls, share subprocessors list, and run initial attestations.

04

Ongoing Review

Periodic audits, breach drills, and annual control reassessments.

Common Mistakes to Avoid When Preparing a DPA

Using vague processing purposes that allow unlimited reuse of data, which increases regulatory and operational risk for both parties.
Failing to list special categories of data such as PHI or financial details, which can leave required safeguards unspecified and unenforced.
Neglecting to include subprocessors or a process for approving them, resulting in surprise third-party exposure and control gaps.
Omitting clear breach notification procedures and timelines, which can delay mandatory disclosures and increase regulatory penalty exposure.

Security and Compliance Controls to Specify in the DPA

Encryption: AES-256 at rest, TLS 1.2/1.3 in transit

Access Controls: Role-based access and MFA

Audit Trail: Tamper-evident logs and timestamps

Certifications: SOC 2 Type II, ISO 27001

HIPAA: BAA required for PHI processing

21 CFR Part 11: Compliant when required

Penalties and Operational Risks from an Inadequate DPA

Regulatory Fines: HIPAA and other fines possible

Tax Penalties: Incorrect information returns trigger IRC §6721

Breach Costs: Notification and remediation expenses

Contract Liability: Indemnity and damages claims

Operational Disruption: Service interruptions and audits

Reputational Harm: Customer trust and market impact

How Organizations Use DPAs in Practice

Real-world examples illustrate practical benefits and operational adjustments when processors and controllers adopt clear DPAs.

Tech Data

Tech Data standardized DPAs across vendors to accelerate integrations and reduce legal review cycles.

Bulk processing improved onboarding times by reducing bespoke amendments.
The standardized approach improved internal efficiency and reduced time-to-production while preserving required audit and security commitments for large enterprise customers.

Fertility Centers of Illinois

The organization implemented explicit subprocessors lists and strict PHI handling clauses to meet clinical requirements.

Focus on HIPAA and auditability drove requirements.
This clarity allowed secure remote workflows, maintained compliance during audits, and ensured patient data protections were consistently applied across vendors and integrations.

Comparing eSignature Pricing and Key Capabilities for DPA Execution

Cost and baseline capabilities vary; signNow is listed first for direct comparison. Compare starting price, trial availability, bulk send, audit trail, HIPAA support, and envelope caps.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes (premium tier)	Varies by plan	Varies by plan	Yes	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About the Business Data Processing Agreement

Answers to common legal, technical, and operational questions about drafting, signing, and enforcing a DPA.

Need help? Contact support

Are electronic DPAs legally enforceable?
Yes. In the United States electronic signatures are generally binding under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure intent, consent, attribution, and retention are documented.
Do I need a BAA for HIPAA-covered data?
Yes. If the processor will handle protected health information, a Business Associate Agreement is required and HIPAA safeguards must be implemented and documented.
When is notarization required for a DPA?
Notarization is not typically required for DPAs, but state or counterparty practices may demand notarized signatures for certain related instruments; verify state rules and contract terms.
How should I handle requests to revoke consent?
Include a withdrawal procedure that explains effects of revocation, timelines for ceasing processing, and data return or deletion steps consistent with ESIGN consumer-disclosure obligations.
Can I update a signed DPA later?
Yes, but amendments should be executed by authorized signatories via a signed amendment or replacement agreement; document effective dates and retention of previous versions.
What if a party discovers incorrect data handling?
Follow the contract’s breach procedures: notify affected parties, remediate deficiencies, preserve logs for audits, and cooperate with regulatory investigations as required.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now