Can this extension be e-signed?

Yes. Under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are legally effective for most contracts. Exceptions include a few testamentary or court-ordered documents; ensure the transaction does not fall within statutory exclusions before relying solely on eSignature.

Is notarization required?

Generally no for commercial contract amendments, but some counterparties or specific state laws may request notarization for evidentiary purposes. If a notary is required, confirm whether Remote Online Notarization is accepted in the relevant state and follow state notary rules.

How do we add subprocessors properly?

Specify subprocessors in the extension, include notice timelines, and provide an objection process. Require subprocessors to accept equivalent contractual commitments. Maintain an up-to-date list and notify controllers per the agreed timeframe.

What if a signatory lacks authority?

If a signatory lacks authority, the extension may be unenforceable against the non-signing party. Verify internal signing authority before execution, and consider a ratification clause or board resolution to cure authority defects.

How long must the executed extension be retained?

Retain executed agreements for the active term plus applicable post-termination periods. Follow federal minima where relevant (for tax records, see IRC §6501(a)) and industry rules such as HIPAA retention (45 CFR §164.530(j)). State rules may extend these periods.

What authentication level is recommended?

Use stronger authentication (SSO, SMS code, or KBA) for high-risk processing. For healthcare or regulated financial processing, adopt higher-assurance methods and capture identity metadata in the audit trail to support compliance and non-repudiation.

Electronic Signature
Templates
Miscellaneous
Data Processing Agreement Extension

Data Processing Agreement Extension

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA PROCESSING AGREEMENT EXTENSION

This Data Processing Agreement Extension ("Extension") is entered into as of by and between ("Data Controller") and ("Data Processor"). This Extension amends the existing Data Processing Agreement dated (the "Original Agreement").

WHEREAS

1. The parties entered into the Original Agreement to govern processing of personal data and agreed certain terms and obligations with respect to such processing.

2. The parties desire to extend the term and adjust scope and payment arrangements for additional data processing activities as set forth in this Extension.

3. Except as expressly modified by this Extension, the Original Agreement remains in full force and effect and shall continue to govern the parties' rights and obligations.

SCOPE OF WORK

Description of Additional Processing Activities

The Processor will perform the additional processing activities described above in accordance with the Original Agreement and this Extension. The Processor shall maintain technical and organizational measures appropriate to the risk of the processing to ensure confidentiality, integrity, availability and resilience of processing systems.

PAYMENT TERMS

Total Additional Fees Payment Schedule Late Payment

Amounts not paid when due shall accrue interest at a rate equal to % per month (or the maximum permitted by applicable law, if lower). In addition, the Processor may suspend performance of services if payment is overdue for more than days following written notice.

TERM AND TERMINATION

Extension Term Commencement Date:

Extension Term Expiration Date:

Notice Period for Termination Without Cause (days)

Either party may terminate this Extension for material breach of the Original Agreement or this Extension if the breaching party fails to cure such breach within days after receipt of written notice. Termination of this Extension shall not relieve either party of obligations accrued prior to termination, including payment obligations.

CONFIDENTIALITY

Each party shall continue to treat as confidential all Confidential Information received from the other party in accordance with the Original Agreement. The Processor shall not disclose Controller's Confidential Information to any third party except as permitted by the Original Agreement or as required by applicable law, and shall ensure that any permitted subprocessor is bound by written obligations of confidentiality at least as protective as those in the Original Agreement.

Duration of Confidentiality Obligations (years)

DATA PROTECTION AND COMPLIANCE

The Processor shall process personal data only on documented instructions from the Controller, implement appropriate technical and organizational measures, assist the Controller with data subject requests, and promptly notify the Controller of any personal data breach in accordance with the Original Agreement. Processor shall comply with applicable data protection laws and shall impose equivalent obligations on any subprocessors.

Primary Contact for Notices (Controller) Primary Contact for Notices (Processor)

GOVERNING LAW

This Extension shall be governed by and construed in accordance with the laws of without regard to conflict of law principles.

ENTIRE AGREEMENT

Except as expressly modified by this Extension, the Original Agreement remains unmodified and in full force. This Extension, together with the Original Agreement, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous agreements and understandings regarding that subject matter. In the event of any conflict between the terms of the Original Agreement and this Extension, the terms of this Extension shall control.

IN WITNESS WHEREOF, the parties have caused this Extension to be executed by their duly authorized representatives.

Data Controller:

By:

Date:

Data Processor:

By:

Date:

What a Data Processing Agreement Extension Is

The Data Processing Agreement Extension is a concise legal addendum that updates or extends an existing Data Processing Agreement (DPA) between a data controller and a data processor. It records changes to processing activities, adds or removes subprocessors, amends retention schedules, and confirms continuing security obligations and compliance with applicable U.S. laws. The extension normally references the original DPA, specifies effective and termination dates, lists affected data categories and technical safeguards, and clarifies which jurisdiction's law will govern interpretation and enforcement.

Why you might use a Data Processing Agreement Extension

A Data Processing Agreement Extension lets parties address discrete changes without redrafting the full contract. It preserves existing obligations, documents new subprocessors or purposes, and shortens negotiation time while maintaining legal continuity under ESIGN, UETA, and contractual terms.

Who typically prepares and signs these extensions

Typical parties include data controllers, processors, IT service providers, and legal teams updating operational or compliance terms.

Data controllers — privacy, compliance, or procurement teams initiating scope or retention changes.
Data processors — vendors adding subprocessors, new services, or updated security measures.
Legal and privacy counsel — review clauses for liability, breach notification, and regulatory alignment.

Confirm internal authority and ensure the extension references the original DPA to prevent ambiguity about prior commitments.

Who signs and why it matters

Controller

The controller determines processing purposes and typically initiates extensions when business operations or legal requirements change. Controllers coordinate with privacy, procurement, and IT teams to define data categories, retention modifications, and required contractual protections to satisfy regulatory obligations.

Processor

The processor implements technical and organizational measures and records processing activities. Processors update subprocessors, confirm security controls, and provide assurances about encryption, access management, and incident response timelines included in the extension.

Essential elements to include in a professional extension

A well-drafted Data Processing Agreement Extension is specific and measurable. Each component below helps reduce ambiguity, support audits, and demonstrate adherence to U.S. legal standards and industry requirements.

Scope

Describe precise processing activities added or modified, including subprocesses, data categories, geographic scope, and permitted purposes. Avoid vague language to prevent disputes and ensure controllers and processors have aligned expectations.

Data Types

List personal data categories, special categories (sensitive) if applicable, and any pseudonymized or aggregated datasets. Clearly mark elements subject to HIPAA to trigger required addenda or Business Associate Agreement terms.

Security

Specify technical and organizational measures such as AES-256 encryption at rest, TLS 1.2/1.3 in transit, access controls, logging, vulnerability management, and periodic security testing. Reference compliance certifications where applicable.

Subprocessors

Require a current subprocessors list, an approval process for additions, and equivalent contractual protections. Define notification timelines and permit the controller to object or require specific mitigation measures.

Liability

Allocate responsibility for breaches, indemnities, and caps. Include insurance requirements where appropriate and specify consequences for failure to meet security obligations or for unauthorized data access.

Term & Termination

State effective date, duration, renewal terms, and deletion or return obligations on termination. Clarify survival clauses for confidentiality, liability, and audit rights beyond termination, including post-termination retention periods.

Step-by-step: prepare, approve, and execute an extension

Use this sequence to prepare, review, and execute a Data Processing Agreement Extension safely and in compliance with applicable U.S. signature laws.

01

Prepare: Reference the original DPA, list the changes, and draft precise amendment language for each modified clause.
02

Review: Legal, privacy, and security teams verify obligations, assess risk, and confirm required technical safeguards and notice periods.
03

Authorize: Obtain internal approvals and verify signatory authority for each party before issuing the document for signature.
04

Sign & Record: Execute with compliant eSignature, capture the audit trail, distribute final copies, and store the executed extension securely.

Configure an online workflow for execution and retention

Set up a digital workflow that enforces signer order, collects authentication, and preserves an immutable audit trail.

Field	Configuration
Signer Order	Sequential routing by role, for example legal then CISO then executive signatory.
Authentication	Email plus SMS code or SSO; use stronger methods for high-risk processing.
Conditional Fields	Show subprocessors or special clauses only if relevant to the chosen options.
Retention	Attach retention policy and automatic archival or deletion workflows after expiration.

Typical electronic execution flow

Typical routing and signing flow illustrates upload, field placement, signer authentication, and completion recording steps for an extension.

Upload: Add the extension PDF and reference the original DPA within the document.
Place Fields: Insert signature, date, and initial fields and any conditional checkboxes for subprocessors.
Authenticate: Select email link, SMS code, or SSO; use KBA for higher assurance where required.
Complete: Signed parties receive executed copies and a certificate of completion with timestamps and IP logs.

Technical and security considerations for eSigning

Ensure the platform supports required file formats, robust authentication, and retains a verifiable audit trail.

File formats: PDF, DOCX, HTML supported
Integrations: Salesforce, NetSuite, Google Workspace
Authentication: Email, SMS code, SSO, KBA options

Common preparation pitfalls to avoid

Failing to reference the original DPA clearly can create conflicting obligations and uncertainty about which terms survive.
Omitting an effective date or specifying inconsistent dates across sections may lead to disputes over when obligations begin.
Not listing subprocessors or lacking an approval timeline causes operational delays and possible compliance violations.
Using vague security language without measurable controls increases audit findings and regulatory risk during incident review.

Key legal and operational risks if an extension is incorrect

Invalid Extension: Ambiguous scope may void terms

Regulatory Fines: HIPAA and state penalties possible

Breach Liability: Increased exposure for data incidents

Contract Termination: Counterparty may terminate services

Insurance Gaps: Coverage may not extend to new risks

Operational Delay: Unapproved subprocessors halt processing

Timing and notice obligations to watch

Track effective dates, notice periods for subprocessors, and internal review cycles to keep processing lawful and auditable.

Effective Date:

Specify MM/DD/YYYY when the amendment becomes operative.

Subprocessor Notice:

Set a defined notice period for new subprocessors (commonly 10–30 days).

Review Cycle:

Schedule periodic reviews, typically annually or on material changes.

Termination Notice:

Include any required notice period for termination of processing obligations.

Audit Window:

Allow reasonable notice for audits and specify scheduling constraints.

How an extension differs from drafting a new DPA

Compare use cases to determine whether an amendment or a new DPA best fits the change in processing activities.

Criteria	Data Processing Agreement Extension	New Data Processing Agreement
When to use	minor changes	full replacement
Documentation	amendment referencing dpa	standalone contract
Negotiation	shorter, targeted	full negotiation cycle
Signatures	existing signatories suffice	new signatories required

eSignature vendor pricing and feature snapshot for extensions

Compare base pricing and core capabilities across vendors commonly used to execute and store Data Processing Agreement Extensions. Confirm plan details directly with each vendor for enterprise features.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently asked questions about executing a DPA Extension

Answers to common execution, validity, and compliance questions for Data Processing Agreement Extensions in a U.S. context.

Need help? Contact support

Can this extension be e-signed?
Yes. Under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are legally effective for most contracts. Exceptions include a few testamentary or court-ordered documents; ensure the transaction does not fall within statutory exclusions before relying solely on eSignature.
Is notarization required?
Generally no for commercial contract amendments, but some counterparties or specific state laws may request notarization for evidentiary purposes. If a notary is required, confirm whether Remote Online Notarization is accepted in the relevant state and follow state notary rules.
How do we add subprocessors properly?
Specify subprocessors in the extension, include notice timelines, and provide an objection process. Require subprocessors to accept equivalent contractual commitments. Maintain an up-to-date list and notify controllers per the agreed timeframe.
What if a signatory lacks authority?
If a signatory lacks authority, the extension may be unenforceable against the non-signing party. Verify internal signing authority before execution, and consider a ratification clause or board resolution to cure authority defects.
How long must the executed extension be retained?
Retain executed agreements for the active term plus applicable post-termination periods. Follow federal minima where relevant (for tax records, see IRC §6501(a)) and industry rules such as HIPAA retention (45 CFR §164.530(j)). State rules may extend these periods.
What authentication level is recommended?
Use stronger authentication (SSO, SMS code, or KBA) for high-risk processing. For healthcare or regulated financial processing, adopt higher-assurance methods and capture identity metadata in the audit trail to support compliance and non-repudiation.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now