Is an eSignature legally binding?

Yes. Under the ESIGN Act and UETA, electronic signatures are enforceable if intent, consent, attribution, and reliable record retention are present (15 U.S.C. §7001 and applicable UETA provisions). Ensure parties consent to electronic records.

When is a BAA required?

A Business Associate Agreement is required when a processor handles protected health information covered by HIPAA; include specific HIPAA safeguards and breach timelines in the DPA and obtain a signed BAA.

Do subprocessors need to be listed?

Yes. Either list allowed subprocessors or require prior notice and approval. Include flow-down obligations so subcontractors meet the same security and notification requirements as the primary processor.

What happens after a data breach?

Follow the DPA breach-notification process, preserve evidence, notify affected parties and regulators as required (HIPAA breach rules apply where relevant), and cooperate in remediation and forensics.

Can I update the agreement after signing?

Amendments are permitted if both parties agree in writing. Document changes with dated amendments or execute a new agreement; track versions for auditability.

How should I store executed DPAs?

Store signed agreements in a secure contract repository with access logs and retention controls; maintain the audit trail (timestamps, IP addresses) to support legal admissibility.

Business DP Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS DP AGREEMENT

This Business DP Agreement (the "Agreement") is entered into as of (the "Effective Date"), by and between:

Client Name: Client Address:

Client Address

Service Provider Name: Service Provider Address:

Service Provider Address

Recitals

WHEREAS, Client engages Service Provider to perform certain business data processing and related services for the benefit of Client; and

WHEREAS, Service Provider has represented that it has the personnel, expertise and technical means to perform such services in accordance with applicable law and the terms of this Agreement; and

NOW, THEREFORE, in consideration of the mutual covenants and promises set forth below, the parties agree as follows:

Scope of Work

Service Provider shall perform the services described below (the "Services"). The Services shall be performed in a professional and workmanlike manner consistent with industry standards.

Detailed Scope of Work

Payment Terms

In consideration for the Services, Client shall pay Service Provider as set forth below. All fees are exclusive of taxes unless otherwise stated.

Total Payment Amount (USD) Payment Schedule / Milestones Late Payment Fee

Term and Termination

This Agreement commences on the Effective Date and continues until the End Date or until terminated in accordance with this Section.

Start Date End Date / Term Length Notice Period for Termination (days)

Either party may terminate this Agreement for material breach by the other party if the breaching party fails to cure within days after receipt of written notice specifying the breach. Termination shall be without prejudice to accrued rights and liabilities.

Confidentiality

Each party (the "Receiving Party") shall treat as confidential all information disclosed by the other party (the "Disclosing Party") that is identified as confidential or that reasonably should be understood to be confidential given the nature of the information. The Receiving Party will not disclose Confidential Information to third parties except to its employees, contractors or agents who have a need to know and who are bound by confidentiality obligations no less protective than those set forth herein.

Confidentiality Duration (years)

Confidential Information does not include information that: (a) is or becomes generally known to the public through no fault of the Receiving Party; (b) was in the Receiving Party’s possession prior to disclosure; (c) is rightfully received by the Receiving Party from a third party without restriction; or (d) is independently developed without use of the Disclosing Party’s Confidential Information. Upon termination or expiry of this Agreement, the Receiving Party shall promptly return or destroy, at the Disclosing Party’s direction, all Confidential Information and certify such return or destruction in writing.

Data Protection and Security

Service Provider shall implement and maintain appropriate technical and organizational measures to protect processed data against unauthorized or unlawful processing, accidental loss, destruction or damage. Service Provider shall (i) process data only on documented instructions of Client; (ii) ensure confidentiality of personnel; (iii) assist Client with reasonable measures to comply with legal obligations; and (iv) permit audits or provide evidence of compliance upon reasonable request and subject to confidentiality protections.

Liability and Indemnification

Each party shall indemnify, defend and hold harmless the other from third party claims arising from the indemnifying party’s breach of this Agreement, willful misconduct or negligence. Except for breaches of confidentiality or indemnification obligations, the parties' aggregate liability under this Agreement shall be limited to the amount paid by Client to Service Provider in the twelve (12) months preceding the claim. This limitation shall not limit liability for death or bodily injury caused by a party’s negligence or for fraud.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of without regard to conflict of law principles. Exclusive venue for disputes shall be the state or federal courts located in the jurisdiction specified above unless the parties agree in writing otherwise.

Entire Agreement

This Agreement, together with any exhibits or attachments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, representations, and understandings. Any amendment or waiver must be in writing and signed by authorized representatives of both parties.

Miscellaneous

Neither party may assign this Agreement without the prior written consent of the other, except that a party may assign to a successor in connection with a merger or sale of substantially all assets. Notices shall be in writing and delivered to the addresses set forth above unless a different address is provided in writing.

Client Name:

By:

Date:

Service Provider Name:

By:

Date:

What a Business DP Agreement Is and why it matters

A Business DP Agreement (Business Data Processing Agreement) is a contract between a data controller and a data processor that defines how personal and sensitive information will be handled, secured, and returned or destroyed. It assigns roles and responsibilities, sets permitted processing purposes, documents subprocessors, and establishes security controls, breach notification obligations, audit rights, and data retention rules. The agreement is commonly used when a company engages vendors to process PII, PHI, or financial data and complements privacy law obligations and sector-specific standards.

Why a clear Business DP Agreement protects both parties

A well-drafted Business DP Agreement reduces legal risk, clarifies operational responsibilities, and documents security commitments and incident procedures, which helps satisfy regulators and customers.

Who typically signs and manages a Business DP Agreement

After signing, distribute the executed agreement to legal, security, and vendor management teams and store a retrievable copy for audits and regulatory requests.

Procurement and vendor managers — negotiate terms, confirm subprocessors, and maintain executed copies for vendor records.
Privacy and compliance officers — verify data categories, security controls, and breach notification language to meet HIPAA, GLBA, or state privacy laws.
Legal and contracting teams — finalize governing law, indemnity, and liability limits; coordinate notarization if required.

Core provisions to include in a professional Business DP Agreement

Include clear, enforceable clauses that define scope, security, subprocessors, breach handling, data return or deletion, and rights to audit or inspection.

Scope

Describe processing activities, categories of personal data, and the specific business purposes for which the processor may use data.

Roles

Specify controller and processor roles, point people, and decision-making authority for data handling and subject-request responses.

Security

List required technical and organizational measures (encryption, access controls, logging) and reference applicable standards or certifications.

Subprocessors

Require prior notice or consent for subcontractors, and include flow-down obligations matching the main agreement.

Breach Notification

State notification timelines, required contents, and coordination procedures for regulatory reporting and affected individuals.

Retention

Define retention limits, deletion/destruction procedures, and handling of archived or backup data at termination.

Step-by-step: completing and executing the Business DP Agreement

Follow this concise sequence to draft, review, approve, and store the executed agreement.

01

Draft: Prepare terms and populate fields with accurate entity and data details.
02

Internal Review: Have legal, privacy, and security teams confirm obligations and controls.
03

Signatures: Obtain authorized signatures from both parties using compliant eSignature or wet-ink if required.
04

Recordkeeping: Store the executed agreement in contract repository and notify stakeholders.

How to configure an online workflow for the Business DP Agreement

Configure these settings when using an eSignature platform to send and track the DPA.

Field	Configuration
Signature Authentication	Use email plus optional SMS or KBA for higher assurance.
Conditional Fields	Display subprocessor clauses only when subcontractors are present.
Retention Settings	Enable auto-archival and exportable audit trail for compliance.
Audit Trail	Capture IP, timestamps, and signer attribution for evidentiary support.

Delivery, signing, and system compatibility considerations

Ensure the platform can deliver a tamper-evident signed file and a searchable audit trail retained according to your retention policy.

File formats: PDF, DOCX, and fillable forms are commonly supported.
Integrations: Salesforce, NetSuite, Microsoft 365, Google Workspace, Box, and Procore streamline routing and storage.
Security: TLS in transit and AES-256 at rest are baseline technical requirements.

Where to send and how to distribute the executed Business DP Agreement

After execution, circulate the final agreement to legal, privacy, procurement, and IT, and retain a secure master copy for audits.

Execute: Both parties sign using the chosen signing method and date the agreement.
Share Internally: Provide copies to privacy, legal, procurement, and operational owners.
Store Securely: Place the executed file in the contract repository with restricted access.
Provide to Auditors: Make available to regulators or auditors on request with traceable access logs.

Key timing rules and deadlines tied to a Business DP Agreement

Observe these timing expectations when negotiating, executing, and responding to incidents under the agreement.

Execution Deadline:

Complete signing before data transfer or processing begins to avoid unauthorized processing.

Review Cycle:

Review and update the agreement annually or when processing scope changes.

Breach Notification (HIPAA):

Notify affected parties and OCR within 60 days for reportable breaches (45 CFR §164.404).

Regulatory Requests:

Respond to lawful requests within statutory timelines set by the issuing regulator.

Retention Review:

Confirm deletion or archive actions at contract termination per the retention schedule.

Typical milestones from negotiation to operational compliance

A predictable milestone plan helps ensure the agreement is both signed and implemented correctly.

01

Negotiation

Agree core terms and data categories before operational planning.

02

Legal Approval

Legal and privacy review to confirm compliance and risk allocation.

03

Execution

Obtain signatures and distribute executed PDF and audit log.

04

Implementation

Onboard processor, apply security controls, and schedule audits.

Common mistakes to avoid when preparing a Business DP Agreement

Leaving the processing scope vague, which can allow unexpected or noncompliant uses of personal data and increase regulatory exposure.
Omitting subprocessors or failing to require flow-down obligations, creating gaps in accountability when third parties are used.
Using weak or no signature authentication for high-risk processing, undermining evidence of signer intent and attribution.
Failing to align retention and deletion clauses with applicable laws and business needs, leading to unlawful retention or data loss.

Penalties and contractual risks from an incorrect or missing DPA

Regulatory Fines: Significant civil penalties and enforcement actions.

Breach Liability: Costs for notification, remediation, and third-party losses.

Contract Termination: Loss of business and indemnity claims.

Reputational Harm: Customer trust and brand damage.

Audit Findings: Corrective actions and increased oversight.

Indemnity Exposure: Unlimited or uncapped indemnities create outsized financial risk.

Comparing eSignature vendors for executing Business DP Agreements

This vendor snapshot highlights common plan and compliance distinctions relevant to signing and storing DPAs; signNow is listed first per platform comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently asked questions about Business DP Agreements

Answers to common legal, execution, and compliance questions to help you finalize and maintain your Business DP Agreement.

Need help? Contact support

Is an eSignature legally binding?
Yes. Under the ESIGN Act and UETA, electronic signatures are enforceable if intent, consent, attribution, and reliable record retention are present (15 U.S.C. §7001 and applicable UETA provisions). Ensure parties consent to electronic records.
When is a BAA required?
A Business Associate Agreement is required when a processor handles protected health information covered by HIPAA; include specific HIPAA safeguards and breach timelines in the DPA and obtain a signed BAA.
Do subprocessors need to be listed?
Yes. Either list allowed subprocessors or require prior notice and approval. Include flow-down obligations so subcontractors meet the same security and notification requirements as the primary processor.
What happens after a data breach?
Follow the DPA breach-notification process, preserve evidence, notify affected parties and regulators as required (HIPAA breach rules apply where relevant), and cooperate in remediation and forensics.
Can I update the agreement after signing?
Amendments are permitted if both parties agree in writing. Document changes with dated amendments or execute a new agreement; track versions for auditability.
How should I store executed DPAs?
Store signed agreements in a secure contract repository with access logs and retention controls; maintain the audit trail (timestamps, IP addresses) to support legal admissibility.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now