Can a DPA be signed electronically?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most U.S. jurisdictions, provided intent, consent, attribution, and record retention are demonstrable.

Do I need a BAA for healthcare data?

If the processor handles protected health information, include a HIPAA Business Associate Addendum. The BAA must specify permitted uses, safeguards, breach notification and compliance with HIPAA obligations.

How should subprocessors be handled?

Specify approval and notification processes, require subprocessors to flow-down DPA obligations, and reserve audit or objection rights to maintain control over downstream processing.

What happens when laws change?

Include a compliance update clause requiring parties to cooperate and amend the DPA to reflect material legal or regulatory changes affecting processing or transfers.

Is notarization required for DPAs?

Not typically. Notarization is uncommon for DPAs, but certain jurisdictions or internal policies may request notarized signatures or RON for added authenticity—confirm state-specific rules.

How do we amend an executed DPA?

Use a written amendment signed by authorized signatories that references the original agreement, states the modified clauses, and includes an effective date for the changes.

Electronic Signature
Templates
Miscellaneous
Data Processing Agreement Revision

Data Processing Agreement Revision

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA PROCESSING AGREEMENT REVISION

Parties

Controller Name Controller Address Processor Name Processor Address

Recitals

WHEREAS, Controller entered into a Data Processing Agreement on (the Original Agreement) with Processor governing the processing of personal data; and

WHEREAS, the parties wish to amend and restate certain terms of the Original Agreement as of the Amendment Effective Date set forth below to reflect changes in processing activities, security measures, and commercial terms; and

WHEREAS, unless expressly revised herein, all terms and conditions of the Original Agreement remain in full force and effect; the parties agree that this document, together with the Original Agreement to the extent incorporated, will govern the parties' rights and obligations with respect to processing.

Amendment Effective Date

This revision is effective as of .

Summary of Revisions

Scope of Work

Processor shall process personal data on behalf of Controller solely for the purposes described below and in accordance with the documented instructions of Controller. Processor's authorized scope is limited to:

Data Categories and Processing Activities

Categories of Data Processed (check applicable):
Identifiable natural person data (names, email addresses, identifiers)
Special categories of personal data (sensitive data)
Technical data (IP addresses, device identifiers, logs)

Additional Data Categories (if any) Processing Activities

Term and Termination

This revision commences on and expires on , unless earlier terminated in accordance with this Agreement.

Either party may terminate this Agreement for convenience upon days' prior written notice to the other party. Termination for material breach shall be permitted where the breaching party fails to cure within a commercially reasonable period after written notice specifying the breach.

Payment Terms

Controller shall pay Processor for the services subject to this revision in the amounts and on the schedule set forth below. All fees are exclusive of taxes unless otherwise stated.

Total Amount Payable (USD) Payment Schedule Late Fee

Confidentiality

Each party shall keep confidential all non-public information received from the other party, including personal data, trade secrets, and business information, and shall not use or disclose such information except as necessary to perform obligations under this Agreement or as required by law. Confidentiality obligations shall survive termination for a period of years.

Security, Subprocessors, and Data Subject Requests

Processor shall implement and maintain appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Processor's obligations shall include encryption where appropriate, access controls, logging, and incident response procedures.

Processor may engage subprocessors only with Controller's prior written consent. Controller's consent may be given by checking the box below and identifying approved subprocessors as necessary.

Controller consents to the use of subprocessors under the terms of this revision. Subprocessor Details (if known)

Processor shall promptly notify Controller of any legally binding request for disclosure of personal data by a law enforcement authority, unless prohibited; Processor shall cooperate with Controller to the extent permitted by law in responding to data subject requests and regulatory inquiries.

Return or Deletion of Data

Upon termination or expiration of processing services, Processor shall, at Controller's election, delete or return all personal data and certify in writing that retained copies have been securely deleted, except to the extent retention is required by applicable law. Processor shall isolate retained data from any active processing and protect it in accordance with the security provisions of this Agreement.

Governing Law and Dispute Resolution

This Agreement shall be governed by and construed in accordance with the laws of , without regard to its conflicts of law principles. The parties agree to attempt to resolve disputes amicably prior to initiating formal proceedings.

Indemnification and Liability

Each party shall indemnify the other for losses arising from its breach of this Agreement, including breaches of data protection obligations, subject to any caps or limitations expressly set forth in the Original Agreement. Neither party shall be liable for indirect, special, or consequential damages except in cases of intentional misconduct or gross negligence.

Entire Agreement

This revision, together with the Original Agreement and any other written amendments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes any prior written or oral agreements solely to the extent they conflict with the provisions of this revision. No other amendment shall be effective unless executed in writing by authorized representatives of both parties.

Certifications and Notices

Each party represents and warrants that the individual signing below is duly authorized to execute this revision on behalf of that party and that, to the best of its knowledge, the execution and performance of this revision does not violate any other agreement or obligation by which it is bound.

Controller:

By:

Date:

Processor:

By:

Date:

What the Data Processing Agreement Revision Is

A Data Processing Agreement Revision updates the terms governing how a processor handles personal data on behalf of a controller. It clarifies roles, data categories, purposes, technical and organizational safeguards, subprocessor rules, cross-border transfers, security incident response, and deletion or return obligations. The revision formalizes changes triggered by new processing activities, regulatory updates, or corporate restructurings and ensures contracts reflect current legal and operational controls for handling personal information.

Why a Revision Matters for Compliance and Risk Management

Revising a DPA aligns contractual commitments with actual processing, reduces breach exposure, and documents controls required under ESIGN/UETA, HIPAA, and state privacy laws. It creates clear obligations for security, breach notification, data transfers, and subprocessors to limit legal and operational risk.

Who Typically Prepares or Signs a DPA Revision

Final approval is usually by authorized signatories with delegated contracting authority and, where applicable, a privacy officer or chief information security officer.

Legal and privacy teams coordinating contractual language and regulatory alignment.
Information security or IT teams validating technical safeguards and incident response measures.
Procurement or vendor management verifying subprocessor lists and commercial terms.

Typical Signatories and Their Roles

Controller Legal

General counsel or contracting counsel for the controller who ensures the revision preserves controller rights, data subject protections, and appropriate remedies. They verify scope, retention, and international transfer mechanisms and coordinate with privacy and procurement teams before execution.

Processor Representative

A senior operations or compliance officer for the processor who confirms technical safeguards, subprocessor practices, and notification procedures. This signer often accepts processor obligations, documents protective measures, and arranges any required binding corporate rules or SCCs.

Essential Data Elements to Include

Parties Identified: Full legal names

Processing Purpose: Legal basis and purpose

Data Categories: Personal and sensitive types

Security Measures: Encryption, access controls

Subprocessor List: Names and functions

Retention Rules: Retention and deletion terms

Primary Risks of an Inadequate Revision

Regulatory Fines: State privacy or HIPAA penalties

Contract Liability: Indemnity and damage exposure

Data Breach Costs: Notification and remediation expenses

Operational Disruption: Interrupted service and audits

Cross-Border Issues: Transfer restriction violations

Reputational Harm: Customer trust erosion

Common Pitfalls to Avoid When Revising a DPA

Failing to match the contract scope with actual data flows, which creates gaps between obligations and operations.
Leaving subprocessor clauses vague or outdated, preventing timely disclosure of downstream processors and obstructing audits.
Not updating security controls language after technical changes, risking noncompliance with HIPAA or state privacy rules.
Overlooking retention and deletion specifics, which can conflict with statutory obligations like IRS or HIPAA retention rules.

Step-by-Step: How to Complete a DPA Revision

Follow these steps to ensure the revision is accurate, legally compliant, and operationally enforceable.

01

Assess Change: Document new processing activities and reasons for revision.
02

Map Data: List data categories, flow paths, and storage locations.
03

Update Terms: Modify clauses for scope, subprocessors, security, and transfers.
04

Obtain Signatures: Execute with authorized signatories and retain records.

Where to Send and Store the Revised Agreement

Routing and retention depend on contract management practices; follow internal controls and preserve an audit trail for legal and compliance teams.

Contract Repository: Store final signed copy in a secure contract management system
Legal Team: Send executed copy to counsel for records
Information Security: Provide a copy to security for control verification
Compliance Archive: Retain per retention schedule and regulatory requirements

Configuring an Online Revision Workflow

Set up a repeatable digital workflow to route revisions through legal, security, and signatory review with clear version control.

Field	Configuration
Version Control	Auto-tag versions with timestamps and editor names
Review Order	Sequential approvals: Legal → Security → Exec sign-off
Notifications	Email and in-app alerts for pending actions
Audit Trail	Capture IP, timestamp, and signer identity

Digital Signing and eSubmission Considerations

Maintain copies of signed agreements in a secure repository and ensure eSignature records meet ESIGN and UETA legal validity tests.

Authentication: Email link, SMS code, or advanced options
Audit Trail: Detailed logs with timestamps and IP
File Formats: PDF and DOCX preservation support

Typical Timelines and Deadlines During a Revision

Establish clear review and execution timelines to avoid operational delays and to meet any regulatory notification windows.

Internal Review Period:

7–14 days for legal and security review

Subprocessor Notice:

30 days before onboarding new subprocessors

Signatory Response:

7 days typical for executive signature

Breach Notification:

As required by law; HIPAA 60–90 days operationally

Record Retention Start:

Effective date becomes retention baseline

Key Clauses to Include in a Professional DPA Revision

A robust revision clarifies responsibilities, security, and legal remedies in precise operational terms.

Scope of Processing

Define permitted processing activities, data categories, and purposes so both parties have explicit limits on authorized use and transfer.

Security Obligations

Specify technical and organizational measures, encryption standards, and access controls required to protect personal data and support audits.

Subprocessor Management

Describe approval process, notification timelines, required assurances from subprocessors, and the right to audit or object.

Breach Response

Detail incident reporting timelines, required contents of notifications, remediation steps, and coordination responsibilities.

International Transfers

Include lawful transfer mechanisms such as SCCs, binding corporate rules, or other contractual safeguards for cross-border processing.

Termination & Return

Outline data return, secure deletion, and proof of destruction obligations upon contract termination or expiration.

eSignature Pricing and Feature Comparison

Compare common pricing starting points and select features relevant to contract revisions and high-volume signing; signNow is listed first for parity.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 env/user/yr	Varies	Varies	Varies

Practical Tips for a Smooth Revision

Use consistent processes, clear language, and digital controls to reduce back-and-forth and speed approval.

Centralize Documents

Keep master DPA templates in a single contract repository to ensure revisions start from an approved baseline and reduce version conflicts.

Standardize Clauses

Use modular clause libraries for security, transfers, and subprocessors to accelerate legal review while preserving necessary customization.

Log Changes

Record changes and rationale in a change log to provide audit evidence and simplify future updates and dispute resolution.

Use eSignatures

Employ compliant eSignature platforms that capture attribution, timestamp, and audit trails to meet ESIGN and UETA requirements.

Frequently Asked Questions About Revising a DPA

Answers to common legal, technical, and operational questions when updating or executing a Data Processing Agreement.

Need help? Contact support

Can a DPA be signed electronically?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most U.S. jurisdictions, provided intent, consent, attribution, and record retention are demonstrable.
Do I need a BAA for healthcare data?
If the processor handles protected health information, include a HIPAA Business Associate Addendum. The BAA must specify permitted uses, safeguards, breach notification and compliance with HIPAA obligations.
How should subprocessors be handled?
Specify approval and notification processes, require subprocessors to flow-down DPA obligations, and reserve audit or objection rights to maintain control over downstream processing.
What happens when laws change?
Include a compliance update clause requiring parties to cooperate and amend the DPA to reflect material legal or regulatory changes affecting processing or transfers.
Is notarization required for DPAs?
Not typically. Notarization is uncommon for DPAs, but certain jurisdictions or internal policies may request notarized signatures or RON for added authenticity—confirm state-specific rules.
How do we amend an executed DPA?
Use a written amendment signed by authorized signatories that references the original agreement, states the modified clauses, and includes an effective date for the changes.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now