Are electronic signatures valid for a DPA?

Yes. Electronic signatures are generally valid under the federal ESIGN Act (15 U.S.C. §7001) and state UETA statutes where adopted; ensure intent, consent, attribution, and record retention are satisfied.

Do I need a notary or witnesses to sign a DPA?

Typically no; DPAs are contractual and do not usually require notarization or witnesses. Verify only if state law or a specific master agreement requires notarization for amendments.

Does a DPA replace a Business Associate Agreement?

No. For HIPAA regulated exchanges, a DPA does not substitute for a BAA; include HIPAA‑specific BAA provisions or execute a separate BAA as required by 45 CFR Part 164.

How can I update an executed addendum?

Amendments should follow contractual amendment procedures: draft a written amendment, obtain authorized signatures, and record the executed version with the original agreement for auditability.

Who should sign the DPA?

An authorized signatory with legal authority to bind the organization should sign; maintain evidence of delegation if a subordinate signs on behalf of a corporate officer.

How long should I keep the executed DPA?

Retain the executed DPA for the contract term plus applicable retention periods (see federal guidance such as IRC §6501(a) for tax records and 45 CFR §164.530(j) for HIPAA).

Electronic Signature
Templates
Legal
Data Privacy Addendum Form

Data Privacy Addendum Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA PRIVACY ADDENDUM FORM

This Data Privacy Addendum (the "Addendum") is entered into as of Effective Date: by and between: Client Name: , Client Address: ; and Vendor Name: , Vendor Address: .

RECITALS

WHEREAS, Client and Vendor have entered into one or more agreements under which Vendor may receive, process, or otherwise have access to Personal Data on behalf of Client (the "Underlying Agreement"); and

WHEREAS, the parties wish to set forth their respective obligations with respect to the processing, protection, transfer and retention of Personal Data processed in connection with the Underlying Agreement; and

WHEREAS, the parties acknowledge that Client determines the purposes and means of processing Personal Data and Vendor will process Personal Data on behalf of Client as set forth in this Addendum.

NOW THEREFORE, in consideration of the mutual covenants herein, the parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is Processed under the Underlying Agreement. "Processing" has the meaning set forth in applicable data protection law and includes any operation performed upon Personal Data.

1.2 Capitalized terms used in this Addendum and not otherwise defined have the meanings ascribed to them in the Underlying Agreement or applicable law.

2. ROLE OF THE PARTIES

2.1 The parties agree that for the purposes of processing Personal Data under this Addendum the roles are as follows: Client acts as Controller; Vendor acts as Processor unless the parties specify otherwise below.

Client Role: Controller Processor Vendor Role: Controller Processor

3. PROCESSING DETAILS

Purpose of Processing Categories of Personal Data Categories of Data Subjects

4. OBLIGATIONS OF VENDOR (PROCESSOR)

4.1 Vendor shall process Personal Data only on documented instructions from Client unless required to do otherwise by law. Vendor shall notify Client promptly if, in Vendor’s opinion, an instruction infringes applicable data protection law.

4.2 Vendor shall ensure that persons authorized to process Personal Data have committed to confidentiality and are subject to appropriate confidentiality obligations.

4.3 Vendor shall implement and maintain technical and organizational measures appropriate to the risk, as described in Section 5 below.

4.4 Vendor shall assist Client, insofar as reasonably possible, in responding to requests by Data Subjects to exercise their rights under applicable data protection law.

5. SECURITY MEASURES

5.1 Vendor shall implement at a minimum the following safeguards, appropriate to the state of the art and the nature of the processing: access controls; encryption of Personal Data in transit and at rest where technically feasible; regular vulnerability management; logging and monitoring; least-privilege access; secure development and change management; and incident response procedures.

Specific Security Measures Implemented by Vendor

6. SUBPROCESSORS

6.1 Vendor shall not engage any subcontractor (subprocessor) to process Personal Data without Client's prior written authorization. Where authorization is given, Vendor shall impose on each subprocessor obligations no less protective than those imposed on Vendor under this Addendum.

Vendor Authorization to Engage Subprocessors

Authorized: Yes No

List of Approved Subprocessors (if any)

7. INTERNATIONAL TRANSFERS

7.1 Any transfers of Personal Data to jurisdictions outside the country of origin of the Data Subjects shall be subject to appropriate safeguards, such as contractual transfer mechanisms and technical protections, and shall comply with applicable law. Vendor shall inform Client of the identity of transfer locations and legal basis for transfer.

Planned Transfer Locations / Mechanisms

8. BREACH NOTIFICATION

8.1 Vendor shall notify Client without undue delay and, where legally required, within the timeframe required by applicable law, upon becoming aware of a personal data breach affecting Client's Personal Data. Vendor's notice shall include: nature and scope of the breach, categories and approximate number of data subjects and records affected, likely consequences, and mitigation measures taken.

Notification Timeline (hours):

9. DATA SUBJECT RIGHTS

9.1 Vendor shall, to the extent legally permitted, promptly notify Client of any request received directly from a Data Subject seeking to exercise any rights in relation to Personal Data. Vendor shall assist Client in responding to such requests in accordance with Client's instructions and applicable law.

10. AUDIT AND INSPECTION

10.1 Vendor shall make available to Client all information necessary to demonstrate compliance with the obligations laid down in this Addendum and shall allow for and contribute to audits and inspections, subject to reasonable notice and confidentiality protections. Any audits shall be conducted during Vendor's normal business hours and shall be subject to commercially reasonable limitations.

11. RETENTION AND DELETION

11.1 Vendor shall retain Personal Data only for as long as necessary to fulfill the documented purposes or as required by applicable law. Upon expiry or termination of the Underlying Agreement, Vendor shall, at Client's choice, delete or return all Personal Data to Client and delete existing copies unless retention is required by law.

Retention Period

12. CONFIDENTIALITY

12.1 Each party shall treat Personal Data as confidential and shall not disclose Personal Data except as strictly necessary to perform its obligations under the Underlying Agreement and this Addendum or as required by law, provided that the disclosing party shall provide prior notice to the other party where permitted by law.

13. LIABILITY AND INDEMNIFICATION

13.1 Each party's liability arising out of a breach of this Addendum shall be governed by the liability provisions of the Underlying Agreement, provided that nothing in this Addendum limits either party's liability for willful misconduct or for obligations that cannot be limited by applicable law.

13.2 Vendor shall indemnify and hold harmless Client from any claims, losses or liabilities arising from Vendor's unauthorized processing or other breach of this Addendum, to the extent such liability is caused by Vendor or its subprocessors.

14. NOTICES

Client Notice Contact Vendor Notice Contact

15. AMENDMENTS; WAIVER; COUNTERPARTS

15.1 No amendment to this Addendum shall be effective unless in writing and signed by authorized representatives of both parties. Failure to exercise any right is not a waiver of that right. This Addendum may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

16. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

16.1 Governing Law:

16.2 Severability: If any provision of this Addendum is held invalid or unenforceable, the remainder shall remain in full force and effect and the parties shall replace the invalid provision with a valid provision that achieves the original intent to the greatest extent possible.

16.3 Entire Agreement: This Addendum, together with the Underlying Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes any prior written or oral agreements on the same subject.

17. MISCELLANEOUS

17.1 Survival: The obligations set forth in this Addendum that by their nature should survive termination shall continue in effect as required by applicable law or for the period specified in this Addendum.

17.2 Interpretation: Headings are for convenience only and do not affect interpretation. Where there is a conflict between this Addendum and the Underlying Agreement with respect to Personal Data, the terms providing the greater protection for Personal Data shall prevail.

Client Printed Name:

By:

Date:

Vendor Printed Name:

By:

Date:

What the Data Privacy Addendum Form Is and When It’s Used

A Data Privacy Addendum Form (commonly called a DPA or Data Processing Addendum) is a supplemental agreement that documents how parties handle personal data shared under a primary contract. It sets processing purposes, categories of personal data, security controls, subprocessor rules, cross‑border transfers, breach notification obligations, and retention limits. Organizations use a DPA to align contractual terms with legal requirements (for example HIPAA or state privacy laws), demonstrate accountability, and record responsibilities between controllers and processors before data processing begins.

Why a Data Privacy Addendum Form Matters

A clear DPA reduces regulatory risk, documents legal obligations for both parties, and creates an auditable record of data handling expectations. It helps demonstrate compliance with federal and state privacy laws and industry standards while assigning roles and timelines for breach response and data deletion.

Who Typically Completes and Signs a Data Privacy Addendum Form

Organizations exchange DPAs whenever one party will process personal data on behalf of another; common participants include vendors, SaaS providers, and enterprise customers.

Data controllers and vendors who share or receive personal data for business purposes.
Internal privacy/compliance teams that review legal and technical safeguards before approval.
Procurement or contract teams managing vendor onboarding and contract amendments.

Final signatures are usually executed by authorized contract signatories or delegated officers; legal and privacy owners should retain the fully executed DPA with the master agreement.

Core Elements to Include in a Professional Data Privacy Addendum

A professional DPA is concise but specific. Include precise scope, data types, responsibilities, security controls, subprocessors, and notification duties so obligations are enforceable and auditable.

Scope

Define processing activities, services covered, and which contractual relationship governs the addendum; avoid ambiguous or open‑ended language that could expand liability.

Data Categories

List categories of personal data processed (identifiers, health, financial, minors) rather than itemizing every data field; clarity helps apply security and retention rules.

Security Controls

Specify minimum technical and organizational measures, encryption requirements, and authentication expectations to ensure a baseline of protection for shared data.

Data Transfers

Explain cross‑border transfer mechanisms, transfer safeguards, or appropriate legal bases when data leaves the United States or moves between group entities.

Subprocessors

Require prior notice or approval for new subprocessors, describe audit or certification rights, and set termination remedies if subprocessors fail obligations.

Breach Notification

Set maximum notification windows, the required content of incident reports, and coordination expectations for remediation and regulatory reporting.

Essential Data Points the Form Must Contain

Party Names: Full legal names

Contact Information: Privacy officer contact

Processing Activities: Short activity list

Data Categories: Types of personal data

Legal Basis: Contractual/legal basis

Effective Date: MM/DD/YYYY

Step‑by‑Step: Filling Out and Executing a Data Privacy Addendum

Follow these sequential steps to complete, review, and execute the DPA with minimum delay.

01

Prepare Draft: Populate party names, effective date, and processing scope.
02

Legal Review: Have counsel confirm liability and termination clauses.
03

Privacy Review: Verify security measures and breach procedures align with policy.
04

Execution: Collect authorized signatures and distribute executed copies to stakeholders.

Configuring an Online Workflow for the Addendum

Set up a digital workflow that enforces order, authentication, and record retention for the addendum.

Field	Configuration
Signature Field	Require signer name and date; make field mandatory
Authentication	Use email link or SMS code for signer verification
Conditional Fields	Show subprocessor lists only when applicable
Reminders	Set automated reminders and expiration notices

Technical Requirements for eSigning and eSubmission

Use a platform that supports reliable audit trails, secure storage, and the document formats your organization uses.

Document Formats: PDF, DOCX supported
Integrations: CRM and cloud storage
Security Standards: TLS 1.2/1.3; AES‑256

Ensure the service captures timestamps, signer attribution, and a tamper‑evident record; confirm BAA availability for HIPAA environments and verify integration needs with your tech stack.

Where to Send and How to Route the Executed Addendum

Routing depends on internal policy; maintain a clear copy path to legal, privacy, and the responsible business owner after execution.

Send to Privacy Officer: Deliver executed copy for compliance records
Retain with Contract: Attach DPA to master services agreement
Distribute to IT: Inform operations teams of control obligations
Store Securely: Archive in encrypted document repository

Typical Timelines and Processing Expectations

Track target timeframes to avoid delays: completing review, obtaining signatures, and communicating updates are time‑sensitive parts of vendor onboarding.

Review Cycle:

7–14 business days for legal and privacy review

Signature Period:

7–30 days depending on counterparty availability

Breach Notification:

Follow statutory windows applicable to your industry

Renewal/Amendment:

Negotiate updates before renewal or significant change

Record Retention:

Retain executed DPAs per internal retention schedule

Common Mistakes to Avoid When Preparing a DPA

Leaving the scope vague so the processor can repurpose data beyond intended uses, increasing compliance risk.
Failing to list subprocessors or a mechanism for their approval, which can cause contractual disputes later.
Omitting breach notification timelines or required content, creating regulatory and coordination gaps during incidents.
Using inconsistent party names or mismatched signature blocks, which can invalidate execution or cause enforceability issues.

Risks and Potential Consequences of an Inadequate Addendum

Regulatory Fines: Civil penalties and enforcement actions

Contractual Liability: Indemnities and damages exposures

Data Breach Risk: Operational and remediation costs

Service Termination: Loss of access to vendor services

Reputational Harm: Customer trust erosion

Litigation: Class actions or private suits

eSignature Provider Comparison for Executing a Data Privacy Addendum

Compare plan basics and key compliance features when choosing an eSignature platform for DPAs. signNow appears first per vendor comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7‑day free trial, no credit card	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

FAQs and Common Questions About the Data Privacy Addendum Form

Answers to frequently asked questions address execution, eSignature validity, revisions, and recordkeeping for Data Privacy Addendum Forms.

Need help? Contact support

Are electronic signatures valid for a DPA?
Yes. Electronic signatures are generally valid under the federal ESIGN Act (15 U.S.C. §7001) and state UETA statutes where adopted; ensure intent, consent, attribution, and record retention are satisfied.
Do I need a notary or witnesses to sign a DPA?
Typically no; DPAs are contractual and do not usually require notarization or witnesses. Verify only if state law or a specific master agreement requires notarization for amendments.
Does a DPA replace a Business Associate Agreement?
No. For HIPAA regulated exchanges, a DPA does not substitute for a BAA; include HIPAA‑specific BAA provisions or execute a separate BAA as required by 45 CFR Part 164.
How can I update an executed addendum?
Amendments should follow contractual amendment procedures: draft a written amendment, obtain authorized signatures, and record the executed version with the original agreement for auditability.
Who should sign the DPA?
An authorized signatory with legal authority to bind the organization should sign; maintain evidence of delegation if a subordinate signs on behalf of a corporate officer.
How long should I keep the executed DPA?
Retain the executed DPA for the contract term plus applicable retention periods (see federal guidance such as IRC §6501(a) for tax records and 45 CFR §164.530(j) for HIPAA).

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now