Can a DPA amendment be signed electronically?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted. Ensure consent to electronic records and retention capability to meet legal evidentiary requirements.

Who must sign the amendment?

An authorized representative with corporate signing authority for each party must sign. Verify corporate authority internally and match the signatory name and title to existing contracts or board resolutions.

Is notarization required for validity?

Notarization is generally not required for contract amendments, including DPAs, but may be requested by parties or required for specific state-law contexts; check state rules and RON availability.

How do I record the effective date?

State the effective date in MM/DD/YYYY format within the amendment and ensure all signature dates align. If retroactive application is intended, include explicit language describing the retroactive effect.

Can the amendment change liability or indemnity?

Yes. Amendments can modify liability caps and indemnities, but such changes should be clearly drafted, reviewed by counsel, and specifically referenced to the original DPA provisions.

How should signed amendments be stored?

Retain digitally signed originals and audit trails in a secure repository with access controls and retention scheduling. Keep copies for applicable statutory periods such as IRS or HIPAA retention requirements.

Electronic Signature
Templates
Legal
Data Processing Agreement Amendment

Data Processing Agreement Amendment

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Data Processing Agreement Amendment

This Data Processing Agreement Amendment (the "Amendment") is entered into as of Effective Date: by and between Controller: a(n) with principal place of business at (\"Controller\"), and Processor: a(n) with principal place of business at (\"Processor\").

RECITALS

WHEREAS, Controller and Processor are parties to a Data Processing Agreement dated (the "DPA");

WHEREAS, the parties desire to amend the DPA to modify certain provisions governing the processing, transfer and security of Personal Data, and to reflect changes in processing operations described herein; and

WHEREAS, capitalized terms not otherwise defined in this Amendment have the meanings given to them in the DPA.

NOW, THEREFORE, in consideration of the mutual covenants set forth herein and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the parties agree as follows:

1. AMENDMENT

1.1 Amendment to DPA. The DPA is hereby amended as set forth in this Amendment. To the extent of any inconsistency between the terms of this Amendment and the DPA, the terms of this Amendment shall prevail.

1.2 Specific Modifications. The following specific modifications are made to the DPA:

Describe exact DPA provisions to be amended

2. DEFINITIONS AND INTERPRETATION

2.1 Definitions. All capitalized terms used but not defined in this Amendment shall have the meanings given in the DPA. For purposes of this Amendment, "Personal Data", "Processing", "Controller", "Processor" and "Data Subject" shall be construed in accordance with applicable data protection law.

2.2 Priority. In the event of any conflict between this Amendment and any schedule or annex to the DPA, the order of priority shall be: (a) this Amendment, (b) the main body of the DPA, (c) any schedules or annexes to the DPA.

3. SCOPE OF PROCESSING

3.1 Categories of Data Subjects:

3.2 Categories of Personal Data:

Purpose(s) of processing Retention period for Personal Data

4. SECURITY AND TECHNICAL MEASURES

4.1 Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These measures shall include, at a minimum, the following as applicable to the processing:

Encryption of Personal Data in transit and at rest
Role-based access controls and least-privilege policies
Audit logging and monitoring
Pseudonymization where practicable
Regular backups and secure restoration procedures

4.2 The Processor shall notify Controller without undue delay after becoming aware of a Personal Data breach and shall provide reasonably requested information to enable Controller to meet its obligations to notify supervisory authorities and Data Subjects where required by law.

5. SUBPROCESSORS

5.1 Controller expressly authorizes the Processor to engage subprocessors subject to the terms of the DPA as amended hereby. The Processor shall ensure that any subprocessor enters into written obligations no less protective than those in the DPA.

List of new or approved subprocessors (if any)

5.2 Where Processor intends to appoint a new subprocessor, Processor shall provide Controller with prior written notice and the opportunity to object on reasonable grounds relating to data protection. If Controller objects, the parties shall use commercially reasonable efforts to resolve the objection.

6. INTERNATIONAL TRANSFERS

6.1 Transfers of Personal Data to jurisdictions outside the territory in which the Data Subjects reside shall be subject to appropriate safeguards under applicable data protection law. Processor shall implement and document such safeguards and shall provide summaries of such safeguards to Controller upon request.

Countries or regions where Personal Data may be transferred

7. AUDIT, INSPECTION AND RECORDS

7.1 Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations set out in the DPA and this Amendment, and shall allow for and contribute to audits and inspections by Controller or an independent auditor appointed by Controller, subject to reasonable confidentiality protections and advance notice.

Audit contact name and title Audit contact email or phone

8. LIABILITY AND INDEMNITY

8.1 Each party's liability for breach of its obligations under this Amendment shall be subject to the limitations and exclusions set forth in the DPA, except as provided in this Amendment.

Monetary cap on liability for Processor (if different)

8.2 Indemnity. Processor shall indemnify and hold harmless Controller from and against any losses, damages, fines or penalties resulting from Processor's breach of its obligations under the DPA and this Amendment to the extent caused by Processor's acts or omissions.

9. TERM AND TERMINATION

9.1 Term. This Amendment shall commence on the Effective Date and shall continue in effect for the term specified in the DPA, unless earlier terminated in accordance with the DPA or by mutual written agreement of the parties.

9.2 Effect of Termination. Upon termination of the DPA, Processor shall, at Controller's direction, return or securely destroy all Personal Data in accordance with the DPA and provide certification of such destruction where requested by Controller.

10. CONFIDENTIALITY

10.1 Each party shall keep confidential and shall not disclose to any third party any Personal Data or any non-public technical or business information received from the other party in connection with the DPA and this Amendment, except as otherwise permitted under the DPA.

11. NOTICES

All notices, requests, demands and other communications required or permitted hereunder shall be given in writing to the parties at the addresses set forth below or at such other address as a party may designate by notice in accordance with this Section.

Controller notice address Controller notice contact Processor notice address Processor notice contact

12. GENERAL PROVISIONS

12.1 Governing Law. This Amendment shall be governed by and construed in accordance with the laws of without regard to conflict of laws principles.

12.2 Entire Agreement. Except as expressly amended by this Amendment, the DPA remains in full force and effect. This Amendment and the DPA constitute the entire agreement of the parties with respect to the subject matter hereof.

12.3 Severability. If any provision of this Amendment is held invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions shall not be affected or impaired.

12.4 Amendments and Waiver. No amendment to or waiver of any provision of this Amendment shall be effective unless in writing and signed by authorized representatives of both parties. A waiver of any right or remedy is effective only if in writing and shall not operate as a waiver of any other right or remedy.

12.5 Counterparts. This Amendment may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Execution by electronic signature shall be binding and shall have the same force and effect as an original signature.

Controller:

By:

Date:

Processor:

By:

Date:

What the Data Processing Agreement Amendment Is

A Data Processing Agreement Amendment modifies an existing DPA to reflect changes in how personal data is processed, new subprocessors, altered purposes, or updated security measures. It documents revised roles and responsibilities between controller and processor, updates data categories and retention terms, and records effective dates and any transitional safeguards to maintain compliance with contractual and legal obligations.

Why an Amendment Matters for Compliance and Risk

Amending a DPA preserves legal clarity when processing practices change, reduces regulatory risk, and helps maintain obligations under ESIGN/UETA for electronic execution. It protects both parties by aligning contractual terms with current operations, security measures, and legal requirements such as HIPAA where applicable.

Who Typically Prepares or Signs This Amendment

Controllers, processors, and their legal or privacy teams usually prepare and review DPA amendments to ensure operational changes are reflected and compliance obligations remain met.

In-house legal teams and privacy officers who approve scope changes and ensure regulatory alignment.
Third-party processors and vendors that add subprocessors, features, or new data processing activities.
Procurement or vendor management teams responsible for contract lifecycle and signatures.

Final execution often involves authorized signatories from both organizations; technical teams may provide implementation details but typically do not sign the amendment.

Essential Elements to Include in a Professional Amendment

A clear, concise amendment should update scope, roles, safeguards, transfers, liability, and effective date so parties can implement changes without ambiguity.

Scope

Specify which sections of the original DPA are modified, the new processing activities, and any exclusions so obligations remain unambiguous and auditable.

Data Categories

List the personal data types newly processed or removed, including special categories if relevant, so security and compliance obligations map to specific data.

Subprocessors

Name added or replaced subprocessors and the approval or notification process required by the controller for onward processing.

Security Measures

Describe updated technical and organizational safeguards, encryption, access controls, and incident response commitments tied to the amendment.

Transfers

Address cross-border transfers, appropriate safeguards, and any reliance on standard contractual clauses or other lawful transfer mechanisms.

Liability & Indemnity

Clarify changes to liability caps, indemnities, and remedies triggered by the amended processing activities or breaches.

Step-by-Step: Execute a DPA Amendment

Follow these sequential steps to draft, approve, and sign an amendment with legal and operational alignment.

01

Draft update: Identify exact DPA clauses to change and draft clear amendments.
02

Internal review: Legal and privacy review for compliance and risk acceptance.
03

Operational sign-off: Technical teams confirm feasibility and security measures.
04

Execution: Authorized parties sign and date the amendment.

Where the Amendment Goes After Signing

Understand routing, storage, and notification steps so all stakeholders are notified and records remain accessible.

Controller copy: Maintain signed original for legal records and audits.
Processor copy: Processor retains a copy for operational implementation.
Subprocessor notice: Notify affected subprocessors if required by the DPA.
Store securely: Place in secure contract repository with access controls.

Typical Digital Workflow Settings for Online Completion

Configure digital routing and authentication so the amendment is signed securely and traceably when completed online.

Field	Configuration
Authentication	Email + SMS code or SSO
Signing Order	Sequential or parallel as required
Audit Trail	Enable IP, timestamp, and action logs
Document Retention	Set secure archival with access controls

Technical and Security Requirements for eSigning

Choose a signing platform that supports tamper-evident PDFs, audit trails, and configurable authentication to meet contractual and regulatory needs.

Format support: PDF, DOCX, and archival PDF/A
Authentication: Email, SMS, or SSO options
Integrations: CRM, cloud storage, and API

Confirm the platform provides AES-256 at rest and TLS 1.2/1.3 in transit, supports audit logs, and can generate a certificate of completion for the amended DPA.

Legal and Operational Risks if the Amendment Is Incorrect

Regulatory Fines: Possible monetary penalties under applicable law

Data Breach Liability: Increased breach exposure and remediation costs

Contract Termination: Counterparty may claim breach and terminate

Indemnity Claims: Third-party claims for wrongful processing

Operational Disruption: Misaligned expectations delay delivery

Reputational Harm: Loss of customer trust and business

Common Mistakes to Avoid When Preparing an Amendment

Failing to specify exact clauses amended leads to ambiguity about which obligations still apply and can complicate enforcement or audits.
Omitting subprocessors or failing to update notification/approval procedures can breach the original DPA's obligations and put data at risk.
Using vague security language instead of specific controls and standards can create compliance gaps and failed audits during regulatory review.
Not updating effective date or transition provisions can create overlapping obligations and uncertainty during migration or cutover activities.

How an Amendment Differs from a New DPA

Compare execution and legal effect so you can decide whether to amend the existing DPA or negotiate a new agreement.

Criteria	Amendment	New Agreement
Execution method	modify existing	full replacement
Effective date	amends prior date	new effective date
Scope change	targeted changes	comprehensive terms
Signatory consent	both parties required	both parties required

eSignature Vendor Pricing Snapshot for Executing Amendments

Compare basic pricing and compliance features relevant to signing a DPA amendment; signNow is listed first per vendor comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/yr	Varies	Varies	Varies

Frequently Asked Questions About DPA Amendments

Answers to common questions about execution, eSigning, authority, and recordkeeping to help you finalize an amendment correctly.

Need help? Contact support

Can a DPA amendment be signed electronically?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted. Ensure consent to electronic records and retention capability to meet legal evidentiary requirements.
Who must sign the amendment?
An authorized representative with corporate signing authority for each party must sign. Verify corporate authority internally and match the signatory name and title to existing contracts or board resolutions.
Is notarization required for validity?
Notarization is generally not required for contract amendments, including DPAs, but may be requested by parties or required for specific state-law contexts; check state rules and RON availability.
How do I record the effective date?
State the effective date in MM/DD/YYYY format within the amendment and ensure all signature dates align. If retroactive application is intended, include explicit language describing the retroactive effect.
Can the amendment change liability or indemnity?
Yes. Amendments can modify liability caps and indemnities, but such changes should be clearly drafted, reviewed by counsel, and specifically referenced to the original DPA provisions.
How should signed amendments be stored?
Retain digitally signed originals and audit trails in a secure repository with access controls and retention scheduling. Keep copies for applicable statutory periods such as IRS or HIPAA retention requirements.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now