Can a DPA be signed electronically under U.S. law?

Yes. Electronic signatures are legally recognized under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure consent and reliable attribution to meet the four-part e-sign validity test (intent, consent, attribution, retention).

Who must sign a Business DPA Document?

An authorized representative with signing authority should sign; for corporations this is typically a CEO, CFO, or delegated contracting officer. Confirm authority in corporate records to avoid enforceability disputes.

How should PHI be handled in a DPA?

If the processor will access PHI, include or attach a HIPAA Business Associate Agreement and ensure a BAA is executed. HIPAA compliance requires documented safeguards and breach procedures for protected health information.

Is notarization required for a DPA?

Not usually. Most DPAs do not require notarization; check specific state or counterparty requirements. When notarization is requested, follow local notary and RON rules.

How do I amend or update an executed DPA?

Amendments should be in writing and signed by authorized parties. Document change control procedures in the DPA and retain previous versions for audit and dispute resolution.

How long should I keep an executed DPA?

Retain the executed DPA for the contract term plus several years. Follow federal standards where applicable (IRS 3 years, IRC §6501(a)) and HIPAA six-year retention (45 CFR §164.530(j)).

Business DPA Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS DATA PROCESSING ADDENDUM

This Data Processing Addendum ("Addendum") is entered into between:

Client Name: Client Address: Processor Name: Processor Address:

Effective Date:

RECITALS

WHEREAS, Client engages Processor to provide certain services that require Processor to process personal data on behalf of Client; and

WHEREAS, the parties desire to set forth the terms and conditions governing Processor's processing of personal data in order to ensure appropriate protection of such data and compliance with applicable data protection laws.

NOW, THEREFORE, in consideration of the mutual promises contained herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Addendum, the following definitions apply: "Personal Data" means any information relating to an identified or identifiable natural person that is provided or collected in connection with the services; "Processing" means any operation or set of operations performed upon Personal Data; "Applicable Data Protection Law" means the data protection and privacy laws applicable to processing under this Addendum.

2. SCOPE OF WORK

Describe services and processing activities: Categories of Personal Data: Data Subjects: Processing Activities:

3. SECURITY AND ASSISTANCE

Processor shall implement and maintain technical and organizational measures appropriate to the risk, including, as applicable, pseudonymization and encryption of Personal Data, measures to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services, regular testing and evaluation of such measures, and measures to restore availability and access to Personal Data in a timely manner following an incident.

Security Measures (describe):

4. SUBPROCESSING

Processor may engage subprocessors to perform specific processing activities on behalf of Client provided that Processor: (a) imposes written obligations on any subprocessor no less protective than those set forth herein; (b) remains fully liable to Client for the performance of the subprocessor's obligations; and (c) provides Client with notice of any intended changes concerning the addition or replacement of subprocessors.

Authorize engagement of subprocessors:

List of current subprocessors or controls:

5. BREACH NOTIFICATION

Processor shall notify Client without undue delay after becoming aware of a Personal Data breach affecting Client's data and shall provide Client with sufficient information to allow Client to meet any legal obligations to report or inform data subjects. Processor shall cooperate with Client in the investigation, mitigation and remediation of any breach.

Breach notification timeframe (hours):

6. DATA SUBJECT RIGHTS

Processor shall, to the extent legally permitted, promptly notify Client if Processor receives a request from a data subject to exercise rights under Applicable Data Protection Law. Processor shall assist Client by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Client's obligations to respond to data subject requests.

Processor assistance (describe):

7. PAYMENT TERMS

Client shall pay Processor the fees for processing services as set forth below. Fees due under this Addendum are non-refundable unless otherwise stated in a written agreement between the parties.

Payment amount (per billing period): Payment schedule / invoicing details: Payment due (days from invoice): Late fee (percentage per month):

8. TERM AND TERMINATION

This Addendum shall commence on the Effective Date and shall continue for the duration set forth below unless earlier terminated as provided herein.

Term start date: Term end date (or 'ongoing'): Termination notice period (days): Termination for cause (examples and procedure):

Upon termination or expiration, Processor shall, at Client's election, return to Client or securely delete all Personal Data processed on behalf of Client and certify in writing that it has done so, except to the extent retention of such data is required by applicable law.

Data return / deletion procedure:

9. CONFIDENTIALITY

Each party shall treat all Personal Data and non-public business information received from the other party as confidential. Parties shall not disclose such information to any third party except as necessary to perform obligations under this Addendum, or as required by law, and shall use at least the same degree of care to protect such information as it uses to protect its own confidential information, but in no event less than reasonable care.

Confidentiality obligation duration (years):

10. LIABILITY AND INDEMNIFICATION

Each party's liability arising out of or relating to this Addendum shall be governed by the applicable provisions in the primary services agreement between the parties. Notwithstanding the foregoing, Processor shall be liable for damages resulting from Processor's breach of its obligations under this Addendum to the extent required by applicable law and subject to any limitations set forth in the primary services agreement.

11. GOVERNING LAW

This Addendum shall be governed by and construed in accordance with the laws of the state or jurisdiction specified below, without regard to its conflicts of law principles.

Governing law (state or jurisdiction):

12. ENTIRE AGREEMENT

This Addendum, together with the primary services agreement and any exhibits or attachments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous arrangements and understandings relating to such subject matter. In the event of any conflict between this Addendum and the primary services agreement, the terms of this Addendum shall prevail with respect to processing of Personal Data.

13. MISCELLANEOUS

If any provision of this Addendum is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. No amendment to this Addendum will be effective unless in writing and signed by authorized representatives of both parties.

Client:

By:

Date:

Processor:

By:

Date:

What the Business DPA Document Is

A Business DPA Document (Data Processing Agreement) is a contract that sets the terms under which one party (the processor) handles personal or sensitive data on behalf of another (the controller). It allocates responsibilities for security, permitted processing purposes, subcontractors, breach notification, and data return or deletion at termination. In U.S. contexts a DPA complements sectoral rules such as HIPAA for protected health information and addresses cross-border controls when applicable. The document is frequently executed alongside master services agreements or vendor contracts and can be signed electronically under ESIGN and state e-signature laws.

Why a Business DPA Document Matters for Compliance and Risk

A clear DPA reduces legal and operational risk by defining permitted data uses, security obligations, breach procedures, and vendor oversight. It supports regulatory compliance, clarifies liability allocation, and documents due diligence for audits and third-party assessments.

Who Typically Prepares and Signs a Business DPA Document

The signatory is usually an authorized officer or delegated contracting manager with authority to bind the organization.

In-house legal and privacy teams coordinating terms and risk allocation for enterprise vendors.
Procurement or vendor management teams negotiating operational and service-level commitments.
IT/security leaders verifying technical controls and subcontractor lists during onboarding.

Core Clauses to Include in a Professional Business DPA Document

A robust DPA organizes obligations into discrete clauses so obligations are auditable, enforceable, and aligned with applicable law.

Scope of Processing

Specify categories of personal data, purposes of processing, and duration so processing stays within agreed limits and is auditable.

Security Measures

Describe technical and organizational safeguards such as encryption, access control, logging, and incident response to demonstrate risk mitigation.

Subprocessor Controls

Define approval, notice, and flow-down requirements for subcontractors to maintain consistent protection across the supply chain.

Breach Notification

Set contractual timelines, content requirements, and coordination processes for incident response and regulator or data subject notifications.

Audit and Inspection

Allow for audits, attestations, or reports (SOC 2, ISO 27001) and define frequency, scope, and remediation steps for findings.

Data Return or Deletion

Require secure return or verified deletion of data at termination and confirm methods for certifying destruction or transfer.

Step-by-Step: Complete and Execute a Business DPA Document

Follow these core steps to prepare and finalize the DPA from drafting to execution.

01

Draft: Populate standard clauses and fill required fields.
02

Review: Legal and security review for compliance and controls.
03

Sign: Authorized signer executes; use appropriate authentication.
04

Store: Archive executed copy and record audit metadata.

Configure an Online Workflow for the Business DPA Document

Map required settings before sending: signer order, authentication, retention, and audit visibility.

Field	Configuration
Authentication	Email link \| SMS code \| KBA optional
Signature Type	Simple e-signature or PKI-based digital
Routing Order	Sequential or parallel signer flow
Document Retention	Set automated archive and export rules

Technical and Integration Considerations for eSubmission

Ensure your chosen platform meets security and compliance needs and logs a verifiable audit trail for the executed DPA.

Formats Supported: PDF, DOCX, HTML, XLSX
Integrations: CRM and storage systems supported
Authentication Options: Email, SMS, KBA, SSO

Typical Electronic Execution Flow for a Business DPA Document

A standard e-execution path moves the document from sender to signers, with authentication and audit capture at each step.

Upload Document: Sender uploads PDF or DOCX to the signing platform.
Place Fields: Add signature, date, and checkbox fields as required.
Authenticate Signer: Choose email link, SMS code, or stronger verification.
Capture Audit Trail: Platform logs IP, timestamp, and actions for evidence.

Key Timing Items and Common Deadline Expectations

DPAs include several internal and regulatory timelines; define them clearly to avoid disputes and ensure prompt compliance.

Signature Due Date:

Set a clear due date, commonly 7–30 days from receipt.

Breach Notification Deadline:

Contractually specify timing; follow applicable law for regulator notices.

Subprocessor Notice Period:

Require advance notice for new subprocessors, typically 10–30 days.

Renewal or Review Window:

Schedule periodic reviews every 12 months or upon material change.

Record Retention Start:

Retention periods begin at effective date or termination, per clause.

Milestone Timeline: From Negotiation to Live Processing

A simple milestone sequence helps track progress from draft to operational processing.

01

Drafting

Create initial DPA draft and populate required fields.

02

Internal Review

Legal, privacy and security teams review and comment.

03

Execution

Authorized signers complete signatures and dates.

04

Operational Onboarding

Processor implements controls and begins permitted processing.

Common Mistakes When Preparing a Business DPA Document

Leaving processing purposes overly broad, creating ambiguity about permitted use and increasing legal risk.
Failing to list or control subprocessors, which can permit uncontrolled data transfers to third parties.
Not defining breach notification contents or timelines, delaying remediation and regulatory reporting.
Neglecting to require evidence of security controls such as SOC 2 or ISO 27001 reports.

Penalties and Risks from an Incomplete or Incorrect DPA

Regulatory Fines: Fines or enforcement actions under applicable privacy or sector laws

Breach Liability: Direct costs, notification expenses, and remediation obligations

Contractual Damages: Indemnities, liquidated damages, or termination rights may apply

Operational Disruption: Processing suspension or required remediation work

Third-Party Claims: Class actions or consumer claims arising from data misuse

Reputational Harm: Loss of customers or partners due to compliance failures

eSignature Vendor Pricing and Feature Snapshot Relevant to Business DPA Execution

Compare starting prices and key capabilities for common eSignature providers; signNow is listed first as a reference point for baseline features.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	No	No
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About the Business DPA Document

Answers to common execution and compliance questions when preparing or signing a Business DPA Document.

Need help? Contact support

Can a DPA be signed electronically under U.S. law?
Yes. Electronic signatures are legally recognized under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure consent and reliable attribution to meet the four-part e-sign validity test (intent, consent, attribution, retention).
Who must sign a Business DPA Document?
An authorized representative with signing authority should sign; for corporations this is typically a CEO, CFO, or delegated contracting officer. Confirm authority in corporate records to avoid enforceability disputes.
How should PHI be handled in a DPA?
If the processor will access PHI, include or attach a HIPAA Business Associate Agreement and ensure a BAA is executed. HIPAA compliance requires documented safeguards and breach procedures for protected health information.
Is notarization required for a DPA?
Not usually. Most DPAs do not require notarization; check specific state or counterparty requirements. When notarization is requested, follow local notary and RON rules.
How do I amend or update an executed DPA?
Amendments should be in writing and signed by authorized parties. Document change control procedures in the DPA and retain previous versions for audit and dispute resolution.
How long should I keep an executed DPA?
Retain the executed DPA for the contract term plus several years. Follow federal standards where applicable (IRS 3 years, IRC §6501(a)) and HIPAA six-year retention (45 CFR §164.530(j)).

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now