When should I file this form?

Use the form whenever a processor or vendor discovers a security event, change in processing that affects data control, or when contract terms require advance notice. Prompt, factual notification supports the controller’s legal duties and limits downstream liability.

Are electronic signatures valid?

Yes—electronic signatures are legally valid in the United States under the ESIGN Act (15 U.S.C. ch. 96, 2000) and UETA where adopted. Ensure the signature method meets the controller’s authentication requirements and that records are retained.

Do I ever need notarization?

Notarization is rarely required for routine incident notifications, but specific contracts or state laws may demand it. If a notarized attestation is required, follow state notarization rules or use Remote Online Notarization where permitted.

Who must sign the form?

An authorized security or compliance officer at the processor should sign and provide contact details. Controllers may require additional signatures or attestations from senior management depending on contract terms.

How long must I keep the completed form?

Retain signed notifications per the controller’s records policy and applicable law: maintain for investigative and audit purposes, commonly 3–7 years; HIPAA documents require 6 years (45 CFR §164.530(j)).

What supporting documents should I attach?

Attach relevant logs, remediation timelines, forensic reports, and communications. Redact sensitive data when unnecessary and transmit attachments securely to avoid secondary exposure.

Electronic Signature
Templates
Miscellaneous
Controller Notification Form

Controller Notification Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

CONTROLLER NOTIFICATION FORM

Parties

Controller:

Controller Address

Recipient (Party receiving notification):

Recipient Address

WHEREAS

WHEREAS, Controller hereby notifies Recipient of Controller's designation and instructions concerning certain processing activities to be performed by or on behalf of Recipient pursuant to contractual relationship between Controller and Recipient.

WHEREAS, the parties wish to record the scope, duration, security expectations, and administrative terms relevant to the processing described in this notification and to set forth the financial and termination provisions applicable to related services.

WHEREAS, this Controller Notification Form (the "Form") serves as a written notice of Controller's purposes and requirements and is intended to be incorporated into any underlying services agreement between the parties to the extent referenced herein.

Notification Details

Primary Contact at Controller Contact Email Contact Phone Description of Processing Activities Categories of Personal Data Purpose(s) of Processing Recipients or Categories of Recipients Retention Period Contractual and Technical Security Measures

Scope of Work

Provide a concise statement of any deliverables, tasks, or outputs that relate to the processing activities described above. If services are governed by a separate services agreement, summarize the portions that are specifically subject to this notification.

Payment Terms

Total Amount Payable Payment Schedule Late Payment Fee

Term and Termination

This Form becomes effective as of: and shall remain in effect until: unless earlier terminated in accordance with this section.

Notice Period for Termination

Either party may terminate for material breach if the breaching party fails to cure within the notice period specified above. Upon termination, Recipient shall, at Controller's direction, return or securely destroy Personal Data and certify destruction in writing within thirty (30) days.

Confidentiality

Recipient shall maintain the confidentiality of all Confidential Information received from Controller and shall not disclose such information except to personnel or subcontractors who have a need to know and who are bound by confidentiality obligations at least as protective as those set forth herein. Confidential Information includes, without limitation, any Personal Data, technical information, business processes, pricing, and other non-public materials disclosed in connection with this Form. Recipient will implement appropriate administrative, technical, and physical safeguards to protect Confidential Information against unauthorized access, alteration, disclosure, or destruction, consistent with applicable legal requirements.

Governing Law

This Form shall be governed by and construed in accordance with the laws of the jurisdiction specified below without regard to its conflicts of law principles. The parties submit to the exclusive jurisdiction of the courts of that jurisdiction for disputes arising from this Form.

Governing Law Jurisdiction

Notices

All notices or communications required or permitted under this Form shall be in writing and delivered to the addresses listed above or to such other address as either party may designate by written notice. Notices shall be deemed given upon personal delivery, confirmed email delivery, or three business days after deposit with a nationally recognized carrier.

Entire Agreement

This Form, together with any referenced underlying services agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior negotiations, understandings, and agreements. Any amendment to this Form must be in writing and signed by authorized representatives of both parties.

Additional Provisions

If any provision of this Form is held invalid or unenforceable, the remaining provisions will remain in full force and effect. The parties acknowledge that monetary damages may be inadequate to remedy a breach of confidentiality or unauthorized use of Personal Data and that injunctive relief may be sought in addition to any other remedies.

Acknowledgment

By signing below, the undersigned represent and warrant that they are authorized representatives of their respective parties and that the information contained in this Controller Notification Form is true, complete, and accurate to the best of their knowledge.

Controller:

By:

Date:

Recipient:

By:

Date:

What the Controller Notification Form Is and When it’s Used

The Controller Notification Form documents an official notice from a processor, vendor, or internal team to the data controller about a change or event affecting personal data, systems, or processing activities. Typical uses include reporting security incidents, changes in subprocessors, transfers of data, or requests for controller action. The form standardizes key facts — incident description, scope, affected data categories, remediation measures, and contact points — so the controller can assess risk, meet regulatory duties, and record the event for compliance and audit purposes.

Why a Standardized Notification Form Matters

A single, clear form reduces ambiguity, ensures the controller receives the facts needed to meet legal obligations, and creates a defensible record of notification. Standardized details speed triage, minimize follow-up questions, and support regulatory reporting where required.

Who Completes and Receives This Form

Internal security teams, third‑party processors, and vendor compliance officers typically prepare the form and send it to the controller or designated data protection contact.

Data Processors and Vendors — Provide timely incident facts and mitigation actions for controller review and regulator reporting.
Internal IT/Security Teams — Use the form to escalate incidents to the controller and document internal remediation steps.
Legal / Compliance Teams — Review for regulatory obligations and to coordinate notification to affected individuals and authorities.

The controller’s designated recipient (DPO, privacy inbox, or legal lead) should acknowledge receipt and log the notification in the controller’s incident register.

Primary Signers and Contacts

Data Protection Officer

The DPO or privacy lead is authorized to receive and review controller notifications, coordinate regulator reporting, and confirm required disclosures. The DPO documents the controller’s assessment and any decisions about notifications to supervisory authorities and individuals.

Vendor Security Contact

A named security or compliance officer at the processor completes and signs the form, certifying the accuracy of the facts supplied and confirming the steps taken to contain and remediate the event.

Essential Sections to Include in a Professional Form

A complete Controller Notification Form groups facts so the controller can act quickly. Include identifier fields, factual narrative, impact metrics, remediation actions, attestations, and contact details.

Identifier

Unique incident ID, report date, and reference to related ticket or case numbers so the controller can cross‑reference internal records and audit trails.

Summary

Concise description of what occurred, how it was discovered, and the timeframe of exposure; avoid speculation and use precise timestamps where available.

Scope

List affected systems, number and categories of individuals or records, and whether special categories of data (e.g., health, financial) are involved.

Technical Details

High-level technical root cause, access vectors, and indicators of compromise needed for controller risk assessment and forensic follow-up.

Remediation

Actions taken to contain the issue, timeline for fixes, ongoing monitoring, and planned preventive measures to reduce recurrence.

Contacts & Attestation

Named point(s) of contact, phone/email, signature block, and a brief attestation that the information is accurate to the sender’s knowledge.

Step-by-Step: Completing and Sending the Form

Follow a short, documented workflow to ensure timely delivery and recording of the notification.

01

Gather Facts: Collect timestamps, logs, and affected data details before drafting.
02

Draft Notification: Complete the standardized form with factual, non‑speculative language.
03

Authenticate Sender: Sign using an ESIGN‑compliant method and include contact verification.
04

Send & Log: Send to the controller’s designated inbox and record delivery confirmation.

Where to Send the Completed Form

Route the form according to the controller’s policy and the contractual notification clause; include copies to escalation contacts.

Controller DPO: Primary recipient for privacy assessment and regulator coordination.
Security Inbox: Controller’s SOC or security operations team may require the technical details.
Legal / Compliance: Controller’s legal team reviews regulatory obligations and public disclosures.
Vendor Portal: If the controller uses a secure intake portal, upload the form and document the confirmation.

Digital Signing and File Formats to Use

Use file formats and signing methods that preserve metadata and support audit trails.

Preferred Formats: PDF or PDF/A to preserve layout and embedded metadata.
Authentication: Email plus SMS code or stronger multi‑factor authentication.
Audit Trail: Capture IP, timestamps, and signer attribution.

Use secure transmission (TLS) and retain the signed copy and audit record to support regulatory response and later review.

Suggested Online Workflow Settings

Configure the eSubmission workflow to enforce required fields, authentication, and retention automatically.

Field	Configuration
Notification Type	Security Incident \| Mandatory selection
Authentication	Email + SMS code or SSO
Attachments Allowed	PDF, DOCX, log exports
Retention Setting	Retain signed record 7 years

eSignature Vendor Comparison for Controller Notifications

Comparison of common vendor attributes relevant to signed notifications and secure recordkeeping. Prices reflect annual per‑user starting tiers and typical plan distinctions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies	Varies	Varies

Security and Compliance Features to Document

Encryption: TLS 1.2/1.3 in transit; AES‑256 at rest

Audit Trail: Detailed timestamps, IPs, and event history

HIPAA BAA: BAA required for PHI handling

Access Controls: Role‑based access and logging

Authentication: Email, SMS code, or MFA options

Certifications: SOC 2 Type II, ISO 27001, PCI DSS

Consequences of Late or Incomplete Notifications

Regulatory Fines: Potential civil penalties and enforcement actions

Legal Liability: Increased exposure to litigation and class claims

Contract Breach: Breach of contract obligations to the controller

Operational Impact: Delayed remediation and extended outage periods

Reputational Damage: Customer and partner trust erosion

Data Loss: Unmitigated exposure of sensitive records

Common Mistakes When Preparing Controller Notifications

Missing precise timestamps and log excerpts, which forces repeated information requests and slows controller assessment.
Using vague descriptions such as 'unauthorized access' without identifying systems or data categories that were affected.
Failing to include a signed attestation or contact verification, undermining the controller’s ability to confirm authenticity.
Attaching unredacted logs or sensitive files without secure transmission, creating secondary exposure risks.

Recommended Notification Timelines and Internal Deadlines

Establish internal SLAs for reporting and follow the controller’s contractual deadlines; regulatory windows vary by sector and jurisdiction.

Immediate Notification:

Notify controller as soon as incident facts allow, without unreasonable delay.

Initial Report:

Provide an initial form within 24 hours of detection when practicable.

Full Technical Report:

Submit a comprehensive report within 72 hours if feasible.

Regulator Filing:

Controller determines regulator timelines per applicable law and informs processor of obligations.

Affected Individuals:

Controller coordinates individual notifications consistent with state and sector requirements.

Real-World Examples of Notification Workflows

Two brief examples illustrate how organizations use signed notifications to document incidents and speed controller response.

Optica Ventures LLC

Their team reduced turnaround on vendor notifications by standardizing the form and signatures.

They used clear contact fields to speed replies.
Brian Fitzgibbons, COO, noted the interface is simple and easy to use; it improved customer and vendor coordination while providing traceable records for audits and regulatory review.

Martin Properties

A single signed form replaced informal emails for property data incidents.

The form captured system logs and remediation steps.
Tim Martin, Founder, reported processing and executing documents online with full compliance and built‑in security, enabling faster confirmations with tenants and partners.

Frequently Asked Questions About the Controller Notification Form

Answers to common questions about when to use the form, eSigning, notarization, retention, and attachments.

Need help? Contact support

When should I file this form?
Use the form whenever a processor or vendor discovers a security event, change in processing that affects data control, or when contract terms require advance notice. Prompt, factual notification supports the controller’s legal duties and limits downstream liability.
Are electronic signatures valid?
Yes—electronic signatures are legally valid in the United States under the ESIGN Act (15 U.S.C. ch. 96, 2000) and UETA where adopted. Ensure the signature method meets the controller’s authentication requirements and that records are retained.
Do I ever need notarization?
Notarization is rarely required for routine incident notifications, but specific contracts or state laws may demand it. If a notarized attestation is required, follow state notarization rules or use Remote Online Notarization where permitted.
Who must sign the form?
An authorized security or compliance officer at the processor should sign and provide contact details. Controllers may require additional signatures or attestations from senior management depending on contract terms.
How long must I keep the completed form?
Retain signed notifications per the controller’s records policy and applicable law: maintain for investigative and audit purposes, commonly 3–7 years; HIPAA documents require 6 years (45 CFR §164.530(j)).
What supporting documents should I attach?
Attach relevant logs, remediation timelines, forensic reports, and communications. Redact sensitive data when unnecessary and transmit attachments securely to avoid secondary exposure.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now