Establishing secure connection…Loading editor…Preparing document…

Data Handling Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA HANDLING AGREEMENT

This Data Handling Agreement ("Agreement") is entered into as of Effective Date: by and between Client Name: with Address:

and Service Provider Name: with Address:

Client and Service Provider are each referred to herein as a "Party" and collectively as the "Parties". Client acts as the controller of personal data and Service Provider acts as the processor under the terms of this Agreement.

RECITALS

WHEREAS, Client collects and maintains certain Personal Data that is necessary for the performance of its business operations; and

WHEREAS, Service Provider will process Personal Data on behalf of Client in connection with the provision of services described as: (the "Services"); and

WHEREAS, the Parties wish to set forth their respective rights and obligations with respect to the processing, security, confidentiality, and return or deletion of Personal Data.

NOW, THEREFORE

In consideration of the mutual covenants contained herein, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Service Provider on behalf of Client pursuant to this Agreement. Categories of Personal Data to be processed include:

1.2 "Processing" has the meaning given to that term under applicable data protection law and includes collection, access, use, disclosure, transmission, storage, and deletion of Personal Data.

2. SCOPE AND PURPOSE OF PROCESSING

2.1 Service Provider shall process Personal Data only as necessary to perform the Services and only on documented instructions from Client, including with respect to transfers of Personal Data to a third country or an international organisation.

2.2 The specific processing activities to be carried out by Service Provider are described as:

3. DATA SECURITY AND CONTROLS

3.1 Service Provider shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Such measures shall include, at minimum, administrative access controls, data encryption where appropriate, secure development practices, and periodic security testing.

3.2 Service Provider shall ensure that persons authorised to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. SUBPROCESSORS

4.1 Service Provider shall not engage any subprocessor without Client's prior written consent. Client's approval may be provided by written communication to the contact identified in the Notices section. Where Client gives prior general written authorisation, Service Provider may engage specified categories of subprocessors.

5. DATA SUBJECT RIGHTS

5.1 Taking into account the nature of processing, Service Provider shall assist Client by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Client's obligation to respond to Data Subject requests to exercise their rights under applicable data protection law.

6. BREACH NOTIFICATION

6.1 Service Provider shall notify Client without undue delay and, where feasible, not later than hours after becoming aware of a personal data breach affecting Client's Personal Data. Notification shall describe the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.

7. RETURN OR DELETION OF PERSONAL DATA

7.1 Upon termination or expiration of the Services, Service Provider shall, at Client's election, return all Personal Data to Client or securely delete and irretrievably destroy such Personal Data, unless applicable law requires storage of the Personal Data. The selected method is:

8. AUDIT AND RECORDS

8.1 Service Provider shall maintain records of processing activities relating to Personal Data and shall make available to Client all information necessary to demonstrate compliance with this Agreement. Client may, subject to reasonable notice of no fewer than days, audit Service Provider's relevant facilities and records during normal business hours, or obtain equivalent assurances through review of audit reports prepared by independent auditors.

9. LIABILITY AND INDEMNIFICATION

9.1 Each Party shall be liable for breaches of this Agreement to the extent caused by its negligence, wilful misconduct, or breach of applicable law. Service Provider shall indemnify and hold Client harmless from claims, liabilities, losses and costs arising out of Service Provider's breach of its obligations under this Agreement.

10. TERM AND TERMINATION

10.1 This Agreement shall commence on the Effective Date and, unless earlier terminated in accordance with this Agreement, shall continue until the Services are completed or until terminated by either Party upon written notice. Upon termination, the obligations in Sections concerning confidentiality, return or deletion of Personal Data, and liability shall survive.

11. CONFIDENTIALITY

11.1 Each Party shall treat the other Party's Confidential Information, including Personal Data, as confidential and shall not disclose such information except as required to perform under this Agreement or as required by law, provided that the disclosing Party gives prompt notice where permitted by law.

12. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

12.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of:

12.2 Entire Agreement. This Agreement, together with any exhibits and appendices, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior agreements and understandings relating to the subject matter hereof.

12.3 Severability. If any provision of this Agreement is held to be invalid or unenforceable, the remainder of the Agreement shall remain in full force and effect and such provision shall be reformed to the minimum extent necessary to make it enforceable.

13. MISCELLANEOUS

13.1 Notices. All notices required under this Agreement shall be in writing and delivered to the contacts set forth below or to such other contact as a Party may designate by written notice:

13.2 Amendments. Any amendment to this Agreement must be in writing and signed by authorised representatives of both Parties.

13.3 Waiver. No waiver of any breach or right under this Agreement will be effective unless in writing and signed by the Party against whom the waiver is asserted. The failure to enforce any provision shall not constitute a waiver of future enforcement of that or any other provision.

13.4 Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument.

Client Printed Name:

By:

Date:

Service Provider Printed Name:

By:

Date:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What a Data Handling Agreement covers

A Data Handling Agreement (DHA) is a written contract that defines how parties collect, process, store, share, and dispose of personal and sensitive data. It allocates roles and responsibilities (controller vs processor), specifies permitted data uses and categories, documents technical and organizational safeguards, sets retention and deletion rules, and establishes reporting and audit rights to verify compliance with privacy and security laws.

Why a clear Data Handling Agreement matters

A DHA reduces legal and operational risk by documenting obligations, security controls, and breach procedures, and supports regulatory compliance with HIPAA, state privacy laws, and contract requirements.

Why a clear Data Handling Agreement matters

Which organizations typically put a DHA in place

Common users include entities that share or process regulated or sensitive data and their vendors; the DHA clarifies expectations before work begins.

  • Real Estate firms handling tenant records and transaction documents.
  • Healthcare providers and vendors exchanging protected health information.
  • Financial services firms sharing customer financial data with processors.

Use a DHA whenever personal, health, financial, or student data is shared with a third party, subcontractor, or cloud provider to reduce compliance exposure and contractual ambiguity.

Key parties and roles

Data Controller

The organization that determines why and how personal data is processed. Controllers must ensure processors act only on documented instructions, verify safeguards, and maintain contractual authority to audit and terminate noncompliant processors.

Data Processor

A service provider that processes data on behalf of the controller. Processors must follow the DHA, implement technical and organizational measures, subprocessor controls, breach notifications, and permit audits as agreed.

Security and compliance elements to include

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest
Access Control: Role-based access and least-privilege policies
Audit Trail: Immutable logging of access and processing events
BAA / HIPAA: Business Associate Agreement when PHI is processed
Retention Policy: Defined retention and secure deletion methods
Incident Response: Timelines and responsibilities for breach notifications

Potential penalties and commercial risks

Regulatory Fines: HIPAA enforcement exposure (45 CFR §164.530)
Contract Termination: Breach can trigger termination and damages
Civil Liability: Class actions or statutory suits possible
Reputational Harm: Customer loss and brand damage
Operational Disruption: Remediation costs and downtime
Tax/Reporting Penalties: Incorrect data handling may affect filings

Common mistakes when preparing a Data Handling Agreement

  • Using vague definitions for data categories and purposes, which creates ambiguity about permitted processing and complicates audits and compliance.
  • Failing to specify subprocessor approval and notification procedures, leaving controllers unaware of downstream data flows and risks.
  • Omitting measurable security requirements (encryption, logging, access controls), which hinders verification and increases breach exposure.
  • Not aligning retention and deletion terms with applicable laws, resulting in over-retention or premature deletion that can violate regulators or business needs.

Step-by-step: drafting and executing a Data Handling Agreement

A clear sequential approach reduces revision cycles and ensures all compliance elements are included.

  • 01
    Identify Parties: List controller and processor legal names and contacts
  • 02
    Define Data: Specify categories, sources, and recipients
  • 03
    Set Protections: Document security, access, and audit rights
  • 04
    Sign and Store: Execute by authorized signers and retain copies

How execution and eSubmission typically proceed

Digital execution shortens cycles; these stages represent the usual flow from draft to operational use.

  • Draft Agreement: Prepare DHA with required clauses and exhibits
  • Internal Review: Legal and security teams review and mark edits
  • Obtain Signatures: Use eSignature or wet signatures as required
  • Distribute Copies: Provide executed copies to all parties and record retention

Core clauses every professional Data Handling Agreement should include

Include clear, enforceable provisions that map responsibilities, permitted uses, security controls, liability, and audit rights to reduce ambiguity and regulatory risk.

Definitions

Precise definitions for 'personal data', 'processing', 'subprocessor', and other terms to avoid interpretive disputes in enforcement or audits.

Purpose Limitation

Explicitly state the processing purposes and prohibit use for unrelated activities, marketing, or secondary analysis without consent.

Security Controls

Specify technical and organizational measures, encryption standards, access rules, vulnerability management, and testing schedules.

Subprocessor Management

Require prior notice or approval for subprocessors, flow-down obligations, and liability allocation if subprocessors fail to comply.

Breach Notification

Define timelines, content, and escalation for incident reporting and regulatory notifications, including responsibilities to notify affected individuals.

Audit and Records

Grant audit rights, specify evidence to be provided, and require maintenance of processing records for compliance verification.

Supporting items to attach or produce with the DHA

Attach operational materials that clarify technical controls and make the agreement actionable for operational teams and auditors.

Export Formats

Provide signed documents as PDF/A and retain an audit trail; keep machine-readable originals where possible for records and e-discovery.

Audit Trail

Include logs that capture timestamps, actor identity, IP address, and action to support attribution and forensic review.

Version Control

Attach a change log of amendments and include effective dates for each revision to avoid conflicting obligations.

Operational Annex

Add a security and processing annex describing encryption, backup schedules, authentication, and personnel access limits.

Timelines and response expectations to include in the DHA

Define measurable timelines for key obligations so parties can meet regulatory and contractual duties without ambiguity.

Effective Date and Term:

State start date and automatic renewal or termination notice periods

Breach Notification Deadline:

Report significant breaches promptly; HIPAA reporting may require up to 60 days to HHS for large breaches

DSAR Response:

Set a timeframe for responding to data subject access requests

Periodic Review:

Schedule annual contract and security control reviews

Subprocessor Notice:

Require notice and approval timelines before onboarding subprocessors

eSignature pricing and capability snapshot

Comparison of entry pricing and core capabilities across common eSignature vendors; signNow is listed first per vendor conventions.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies by plan Varies by plan Varies by plan Varies by plan
Bulk Send Yes Yes Yes Yes Yes
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No
Envelope Cap No cap 100 envelopes/user/year Varies by plan Varies by plan Varies by plan

Real-world examples of DHAs in use

These examples show how organizations apply DHAs to streamline operations while meeting compliance obligations.

Optica Ventures — COO

Optica implemented a DHA to clarify vendor obligations and speed onboarding.

  • Outcome: simpler customer workflows and fewer questions during sign-up.
  • "The interface is simple and easy-to-use for our team; more importantly, it is just as easy for our customers."

Fertility Centers of Illinois — Founder

A healthcare provider standardized DHAs across vendors to protect PHI and centralize audit reporting.

  • Outcome: consistent BAA flow and clearer breach procedures.
  • "The airSlate SignNow team has been exceptional, responsive, the API has been great, and we're extremely happy that we chose airSlate SignNow as a company."

Practical tips to prepare an enforceable Data Handling Agreement

Follow these best practices to reduce negotiation time and improve operational clarity.

Use precise definitions
Define data categories, processing activities, and parties clearly. Precision prevents scope disputes and supports audits and regulatory reviews.
Limit processing purpose
State narrowly defined purposes and prohibit reuse without written consent to prevent unauthorized secondary processing and compliance gaps.
Specify measurable security
List encryption standards, access controls, logging, and testing intervals. Measurable controls simplify verification and breach response coordination.
Plan for subprocessors
Require notice and flow-down obligations for subprocessors, and maintain a current list of approved subprocessors for controller oversight.

Frequently asked questions about Data Handling Agreements

Answers to common questions about scope, enforceability, and practical execution of DHAs in U.S. contexts.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.