Are electronic signatures valid on DPAs?

Yes. Electronic signatures are generally legally binding under the ESIGN Act (15 U.S.C. §7001) and state UETA laws, provided the signing demonstrates intent, consent, attribution, and retention capability.

When is a BAA required with the DPA?

A Business Associate Agreement is required when the supplier will create, receive, maintain, or transmit protected health information; the DPA and BAA can be combined or attached as separate executed documents.

Who is authorized to sign for the supplier?

An authorized corporate representative—typically a senior legal, commercial, or executive officer—must sign. Confirm the supplier's internal authority limits before execution to avoid invalidation.

How do I update an executed DPA?

Amendments should be documented in a formal amendment signed by both parties. Track version history and retain prior signed copies for audit and dispute resolution.

Can a supplier revoke access or cancel the agreement?

Termination provisions should specify notice periods, data return or deletion actions, and continuity measures. Revocation of access must follow contractual exit procedures to protect both parties.

What file formats should we use for signed DPAs?

Store final, locked PDFs (PDF/A recommended) with the audit trail and timestamps. Keep editable source documents separately and record version metadata.

Electronic Signature
Templates
Legal
Data Processing Addendum for Suppliers

Data Processing Addendum for Suppliers

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Data Processing Addendum for Suppliers

This Data Processing Addendum ("Addendum") is entered into as of Effective Date: by and between Supplier Name: with Registered Address: and Controller Name: with Registered Address: (each a "Party" and together the "Parties").

Recitals

WHEREAS, Controller requires certain services from Supplier that will involve the Processing of Personal Data on behalf of Controller; and

WHEREAS, Supplier will Process Personal Data on behalf of Controller in connection with the provision of the Services described in the underlying agreement between the Parties (the "Underlying Agreement"); and

WHEREAS, the Parties desire to set out their respective obligations with respect to the Processing of Personal Data in accordance with applicable data protection laws and the terms of this Addendum.

NOW, THEREFORE, in consideration of the mutual promises below, the Parties agree as follows:

1. Definitions

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is Processed under this Addendum.

1.2 "Processing", "Process" and "Processed" have the meanings given in applicable data protection laws and include any operation performed upon Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure and destruction.

1.3 "Subprocessor" means any Processor engaged by Supplier to Process Personal Data on behalf of Controller.

2. Details of Processing

The Parties acknowledge and agree the subject-matter, nature and purpose of Processing, the duration of the Processing and types of Personal Data and categories of Data Subjects are set out below.

Processing Purpose Categories of Personal Data Categories of Data Subjects Duration of Processing Location(s) of Processing

3. Roles and Scope

3.1 The Parties agree that Controller is the Controller of Personal Data and Supplier is the Processor for the Processing activities described in this Addendum. Supplier shall Process Personal Data only on documented instructions from Controller, unless required to do otherwise by applicable law.

3.2 Supplier shall not Process Personal Data for any purpose other than those set out in this Addendum or as instructed in writing by Controller. Any additional Processing requested by Controller shall require prior written consent and may be subject to additional terms.

4. Supplier Obligations

4.1 Supplier shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

Summary of Technical and Organisational Measures

4.2 Supplier shall ensure persons authorized to Process Personal Data have committed to confidentiality and shall take reasonable steps to ensure the reliability of any personnel who have access to Personal Data.

5. Subprocessors

5.1 Controller authorizes Supplier to engage Subprocessors to carry out specific Processing activities, subject to Supplier: (a) imposing written obligations on the Subprocessor no less protective than this Addendum; and (b) remaining liable for the acts and omissions of such Subprocessor to the same extent as for Supplier's own acts and omissions.

List of Authorized Subprocessors (if any)

5.2 Supplier shall provide Controller with prior written notice of any intended appointment of a new Subprocessor and shall allow Controller a period to object on reasonable grounds relating to data protection. Failure by Controller to object in writing within the notice period shall constitute deemed consent.

6. International Transfers

6.1 Supplier shall not transfer Personal Data outside the country or region specified in Section 2 without ensuring appropriate safeguards are in place. Such safeguards shall include contractual protections, encryption, or other measures necessary to provide an essentially equivalent level of protection.

Transfer Mechanism / Safeguards

7. Data Subject Rights

7.1 Supplier shall, to the extent legally permitted, promptly notify Controller if it receives a request from a Data Subject to exercise rights (access, rectification, erasure, restriction, objection, portability) and shall not respond to such requests except on Controller's documented instructions or as required by applicable law.

7.2 Supplier shall assist Controller, taking into account the nature of Processing, by implementing appropriate technical and organizational measures insofar as this is possible, to enable Controller to respond to Data Subject requests.

8. Security Incidents and Breach Notification

8.1 Supplier shall notify Controller without undue delay after becoming aware of a Security Incident affecting Personal Data. The notice shall include, to the extent possible, the nature of the incident, categories and approximate number of Data Subjects and records affected, likely consequences and measures taken or proposed to address and mitigate the incident.

Security Incident Contact Name Security Incident Contact Email

9. Audit and Inspection

9.1 Controller or an independent auditor appointed by Controller shall have the right, upon reasonable notice and subject to confidentiality obligations, to audit Supplier's compliance with this Addendum, either remotely or onsite, during normal business hours and no more than once per calendar year unless required by applicable law or a Security Incident occurs.

9.2 Any audits shall be conducted in a manner that does not unreasonably disrupt Supplier's business operations. Supplier may redact confidential business information that is not relevant to the audit scope.

10. Return or Deletion of Personal Data

10.1 Upon termination or expiry of the Underlying Agreement or upon Controller's written request, Supplier shall, at Controller's option, return all Personal Data to Controller and delete existing copies or securely destroy all Personal Data. Where deletion is not technically feasible, Supplier shall continue to protect the Personal Data and shall limit further Processing.

Certification of Deletion Deadline

11. Liability and Indemnity

11.1 Each Party's liability for breaches of this Addendum arising from its own acts or omissions shall be governed by the terms of the Underlying Agreement. Nothing in this Addendum shall limit liability for fraud, willful misconduct, or other liability that cannot be excluded by applicable law.

11.2 Supplier agrees to indemnify and hold harmless Controller against any losses, damages or costs reasonably incurred by Controller arising from Supplier's breach of this Addendum, subject to the terms and limitations contained in the Underlying Agreement.

12. Confidentiality

12.1 Supplier shall treat Personal Data as Confidential Information of Controller and shall not disclose Personal Data to any third party except as authorized by Controller or permitted by this Addendum. Confidentiality obligations shall survive termination of this Addendum.

13. Term and Termination

13.1 This Addendum shall come into force on the Effective Date and shall remain in effect for the duration of the Underlying Agreement or until all Personal Data has been returned or securely deleted in accordance with Section 10.

14. Notices

Controller Notice Contact Controller Notice Address Controller Notice Email Supplier Notice Contact Supplier Notice Address Supplier Notice Email

15. Governing Law; Miscellaneous

15.1 This Addendum shall be governed by and construed in accordance with the laws of: without regard to conflict of laws principles.

15.2 Entire Agreement: This Addendum, together with the Underlying Agreement, constitutes the entire agreement between the Parties in respect of its subject matter and supersedes any prior agreements or understandings relating to such subject matter.

15.3 Severability: If any provision of this Addendum is held invalid, illegal or unenforceable, such provision shall be severed and the remainder of this Addendum shall remain in full force and effect.

15.4 Amendments and Waiver: Any amendment to this Addendum must be in writing and signed by authorized representatives of both Parties. No failure or delay by either Party in exercising any right under this Addendum shall be deemed a waiver of that right.

15.5 Counterparts: This Addendum may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument.

Supplier:

By:

Date:

Controller:

By:

Date:

What the Data Processing Addendum for Suppliers Is

A Data Processing Addendum for Suppliers is a contract appendix that defines how a supplier (processor) will handle personal data on behalf of a buyer or customer (controller). It sets processing purposes, data categories, security measures, subcontractor rules, breach notification, audit rights, and retention obligations. For U.S. transactions it often dovetails with sectoral rules such as HIPAA for protected health information and state privacy laws; for cross-border flows it complements international frameworks and contract clauses. The addendum clarifies responsibilities and reduces regulatory and contractual uncertainty about personal data handling.

Why Including a Supplier DPA Matters

A clear DPA reduces compliance risk by documenting processing roles, security controls, breach response, and subcontractor oversight. It helps both parties meet legal requirements and supports consistent incident handling and audits.

Who Typically Prepares and Signs This Addendum

Organizations that outsource data handling and their contracted suppliers use this addendum to align legal obligations and operational controls.

Corporate legal and procurement teams coordinate contract language and approval workflows for supplier DPAs.
Security and privacy officers review technical and organizational measures and sign off on controls.
Supplier account and contract managers complete operational details and return the executed addendum to the buyer.

The DPA is collaborative: buyers draft or propose language; suppliers review, negotiate limited clauses, and sign when controls and responsibilities are agreed.

Typical Signers and Their Roles

Supplier Authorized Representative

A senior legal or commercial officer who can commit the supplier to contract terms. This signer should understand subcontractor flow-down, data handling obligations, and indemnity exposure and be able to accept or propose limited amendments.

Buyer Data Protection Officer

An in-house privacy or security lead who confirms that the DPA meets the buyer's compliance standards, approves technical controls, and provides post-signature oversight such as audit scheduling and incident coordination.

Essential Information to Include in the Addendum

Parties: Full legal names

Effective Date: MM/DD/YYYY

Data Types: Categories of personal data

Processing Purpose: Permitted processing activities

Security Measures: Encryption, access controls

Subprocessors: Listing and approval process

Principal Risks of an Incomplete or Incorrect DPA

Regulatory Fines: Administrative penalties

Contract Liability: Indemnities and damages

Breach Notification: Mandatory disclosure duties

Operational Disruption: Remediation costs

Loss of Trust: Customer and partner impact

Audit Failures: Remediation and oversight orders

Common Preparation Mistakes to Avoid

Leaving processing scope vague, which creates disputes about permitted uses and can expand liability for the supplier.
Failing to list subprocessors or to include a formal approval or notification process for new subprocessors.
Neglecting to specify security measures and monitoring obligations, producing mismatched expectations between parties.
Using boilerplate breach timelines without aligning to sectoral rules (for example, HIPAA requirements for PHI) or customer incident processes.

Real-World Examples of Supplier DPAs in Use

Two concise examples show how organizations align operational controls and signing authority in practice.

Optica Ventures — COO

Optica required a concise addendum focused on audit access and retention

The supplier agreed to quarterly audit windows and limited subprocessors
The result preserved the business relationship while meeting the buyer's compliance checklist and simplifying future renewals.

Fertility Centers of Illinois — Founder

A healthcare provider required HIPAA-compatible contractual commitments from a SaaS supplier

The supplier executed a BAA and DPA with explicit PHI safeguards
This allowed secure remote processing of patient records and reduced legal uncertainty for care workflows.

Step-by-Step: Completing the DPA

Follow these sequential steps to prepare, negotiate, and finalize a Data Processing Addendum for Suppliers.

01

Draft: Populate parties, scope, and data categories.
02

Review: Legal and security teams verify controls.
03

Negotiate: Agree subprocessors and liability limits.
04

Execute: Authorized representatives sign and date.

Where to Send or File the Executed Addendum

Routing depends on the buyer's contract lifecycle system and the supplier's records policy; these destinations are common.

Buyer Contract System: Upload executed DPA to CLM or contract repository.
Supplier Records: Store signed copy in supplier contract folder.
Security Team: Provide copy to security/privacy reviewers.
Legal Counsel: Retain for audit and dispute support.

Core Clauses to Verify in a Professional DPA

A robust DPA balances operational detail with enforceable contractual commitments; confirm these six clause areas before signature.

Scope

Clearly describe the processing purpose, data categories, and any excluded activities to limit unintended data use.

Security

Specify technical and organizational measures such as encryption, access controls, vulnerability management, and testing frequency.

Subprocessors

Define approval, notification periods, and the right to object to new subprocessors; require equivalent contractual obligations downstream.

Breach Notification

Set timelines, required content for notices, and coordination responsibilities for remediation and regulatory reporting.

Audit Rights

Describe audit frequency, scope, on-site or remote options, cost allocation, and confidentiality protections for audit findings.

Liability & Indemnity

Limitations of liability, carve-outs for intentional breaches, and indemnity mechanics should be negotiated and documented.

How to Configure an Online DPA Workflow

When moving the DPA into a digital process, configure these core settings to support compliance and traceability.

Field	Configuration
Authentication	Email + optional SMS or KBA for higher assurance
Version Control	Lock final version before signature; enable audit trail
Conditional Fields	Show subprocessors only when applicable
Retention Policy	Attach retention metadata and archival rules

Digital Signing and eSubmission Requirements

Use a platform that provides secure transmission, tamper-evidence, and a detailed audit trail for signed DPAs.

Authentication: Email, SMS, or SSO
Audit Trail: Timestamps and IP logging
Formats: PDF/A and DOCX supported

Confirm the chosen solution supports required compliance frameworks (for example, ESIGN and UETA for signature validity and a business associate agreement when PHI is involved). Store signed copies in the contract lifecycle management system with restricted access.

Typical Timelines and Deadlines to Track

Set clear internal deadlines for review, execution, and post-signature onboarding to avoid service interruptions or compliance gaps.

Review Turnaround:

Allow 10–15 business days for legal and security review

Negotiation Window:

Complete commercial negotiations within 30 calendar days

Execution Date:

Effective date is signing date unless otherwise stated

Onboarding:

Provisioning and access typically within 5–10 business days after signature

Audit Scheduling:

Schedule audits at least 30 days' notice to supplier

Practical Tips for Accurate and Efficient Completion

Adopt standard templates, review checklists, and automated workflows to reduce negotiation friction and compliance risk.

Use a Standard Template

Maintain a company-approved DPA template to reduce review cycles and align expectations.

Pre-Approve Subprocessors

Keep a vetted subprocessor list to speed onboarding and reduce objections.

Document Security Controls

Attach a succinct controls matrix to the DPA rather than long narrative descriptions.

Track Versions

Apply version control and require a locked final PDF for signatures to preserve auditability.

eSignature Vendor Pricing Snapshot for Supplier DPAs

Compare typical starting prices and key capabilities for signing and managing supplier DPAs. Pricing models and features vary by vendor and plan.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About Supplier DPAs

Answers to common questions about validity, signatures, updates, and platform compatibility for Data Processing Addendums for Suppliers.

Need help? Contact support

Are electronic signatures valid on DPAs?
Yes. Electronic signatures are generally legally binding under the ESIGN Act (15 U.S.C. §7001) and state UETA laws, provided the signing demonstrates intent, consent, attribution, and retention capability.
When is a BAA required with the DPA?
A Business Associate Agreement is required when the supplier will create, receive, maintain, or transmit protected health information; the DPA and BAA can be combined or attached as separate executed documents.
Who is authorized to sign for the supplier?
An authorized corporate representative—typically a senior legal, commercial, or executive officer—must sign. Confirm the supplier's internal authority limits before execution to avoid invalidation.
How do I update an executed DPA?
Amendments should be documented in a formal amendment signed by both parties. Track version history and retain prior signed copies for audit and dispute resolution.
Can a supplier revoke access or cancel the agreement?
Termination provisions should specify notice periods, data return or deletion actions, and continuity measures. Revocation of access must follow contractual exit procedures to protect both parties.
What file formats should we use for signed DPAs?
Store final, locked PDFs (PDF/A recommended) with the audit trail and timestamps. Keep editable source documents separately and record version metadata.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now