Establishing secure connection…Loading editor…Preparing document…

Data Processing Subprocessor Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Data Processing Subprocessor Agreement

This Data Processing Subprocessor Agreement ("Agreement") is entered into as of Effective Date: by and between Controller Name: Controller Address: and Subprocessor Name: Subprocessor Address: .

Recitals

WHEREAS, Controller engages Processor to provide certain services that involve Processing of Personal Data and requires the assistance of Subprocessor to perform a portion of those services;

WHEREAS, Subprocessor has represented that it has the technical and organizational measures necessary to provide the services in compliance with applicable data protection law and is willing to act as a Subprocessor under the terms of this Agreement;

WHEREAS, the parties intend by this Agreement to set out the respective rights and obligations of the parties with respect to Processing of Personal Data by Subprocessor on behalf of Controller.

NOW THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows:

1. Definitions

1.1 "Personal Data" means any information relating to an identified or identifiable natural person Processed under this Agreement. 1.2 "Processing" and "Process" have the meanings given in applicable data protection law. 1.3 "Subprocessor" means the party identified above engaged to Process Personal Data on behalf of Controller. 1.4 "Confidential Information" means non-public information disclosed in connection with this Agreement that is designated as confidential or that reasonably should be understood to be confidential.

2. Scope and Purpose of Processing

2.1 Subprocessor shall Process Personal Data only for the documented instructions of Controller and for the following purposes:

3. Subprocessor Obligations

3.1 Compliance. Subprocessor shall Process Personal Data only in accordance with Controller's documented instructions and this Agreement, and shall not Process Personal Data for any other purpose. Subprocessor shall ensure that any person it authorizes to Process Personal Data is subject to confidentiality obligations.

3.2 Security. Subprocessor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access in accordance with industry standards. Subprocessor will document such measures and provide a summary upon request.

4. Subprocessing and Flow-Down Obligations

4.1 Authorization. Controller hereby authorizes Subprocessor to engage the subprocessors listed in Subprocessor's written schedule to this Agreement and any additional subprocessors only where Controller has provided prior written authorization. Subprocessor shall notify Controller of proposed new subprocessors and shall not permit such engagement where Controller objects in writing within fourteen (14) days of notice.

4.2 Contractual Flow-Down. Subprocessor shall impose contractual obligations on any engaged subprocessor no less protective than those imposed on Subprocessor under this Agreement, including obligations relating to confidentiality, security, breach notification and return/deletion of Personal Data.

5. Data Subject Rights and Assistance

5.1 Assistance. To the extent legally permitted, Subprocessor shall promptly assist Controller in responding to requests from Data Subjects seeking to exercise their rights under applicable data protection law, including access, rectification, erasure, restriction and data portability, taking into account the nature of Processing and the information available to Subprocessor.

6. Security Breach Notification

6.1 Incident Response. Subprocessor shall notify Controller without undue delay and, in any event, within seventy-two (72) hours of becoming aware of a confirmed Personal Data Breach affecting Controller's Personal Data. The notification will include, to the extent available, a description of the nature of the breach, categories and approximate number of affected Data Subjects and Personal Data records, measures taken and proposed remedial actions.

7. Audit and Inspection

7.1 Audit Rights. Upon reasonable notice, Controller or an independent auditor mandated by Controller shall have the right to audit and inspect Subprocessor's compliance with this Agreement, including review of relevant policies, procedures and technical measures. Audits shall be conducted during regular business hours and in a manner to minimize disruption to Subprocessor's operations.

8. International Transfers

8.1 Transfers. Subprocessor shall not transfer Personal Data to a jurisdiction outside the country where data was originally collected unless such transfer is subject to appropriate safeguards and documented controller instructions. Subprocessor will notify Controller of any proposed transfer and cooperate in implementing agreed safeguards.

9. Return or Deletion of Personal Data

9.1 Deletion or Return. Upon termination or expiration of the services for which Personal Data was Processed, Subprocessor shall, at Controller's option, return all Personal Data to Controller in a commonly used, machine-readable format and/or securely delete all copies, unless retention is required by applicable law. Where retention is required by law, Subprocessor shall isolate and protect Personal Data from further Processing.

10. Confidentiality

10.1 Obligation. Subprocessor shall maintain the confidentiality of Personal Data and shall not disclose such data to any third party except as permitted under this Agreement or required by law. Subprocessor shall ensure that persons authorized to Process Personal Data are bound by confidentiality obligations.

11. Liability and Indemnification

11.1 Liability. Each party shall be liable for direct damages caused by its breach of this Agreement. To the maximum extent permitted by applicable law, Subprocessor shall indemnify and hold harmless Controller from and against claims, losses and expenses arising from Subprocessor's breach of this Agreement or failure to comply with applicable data protection laws.

12. Term and Termination

12.1 Term. This Agreement commences on the Effective Date and continues for the duration of Subprocessor's engagement to Process Personal Data, unless earlier terminated as provided herein. 12.2 Termination for Breach. Controller may terminate this Agreement immediately upon notice if Subprocessor materially breaches its obligations and fails to cure within thirty (30) days following written notice.

13. Governing Law; Venue

This Agreement shall be governed by and construed in accordance with the laws designated by Controller's principal place of business: . The parties submit to the exclusive jurisdiction of the competent courts in that jurisdiction for disputes arising out of this Agreement.

14. Entire Agreement; Severability

14.1 Entire Agreement. This Agreement, together with any schedules and written instructions incorporated herein, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and understandings. 14.2 Severability. If any provision of this Agreement is held invalid or unenforceable, the remainder of the Agreement shall remain in full force and effect and the parties shall negotiate in good faith a valid replacement provision.

15. Notices

15.1 All notices under this Agreement shall be in writing and delivered to the party's designated contact: Controller Notice Contact: Controller Notice Address:

Subprocessor Notice Contact: Subprocessor Notice Address:

16. Amendments; Waiver; Counterparts

16.1 Amendments. No amendment to this Agreement is effective unless in writing and signed by both parties. 16.2 Waiver. Failure to enforce any right is not a waiver of that right. 16.3 Counterparts. This Agreement may be executed in counterparts, each of which is an original and together constitute one instrument.

Miscellaneous

The parties acknowledge that monetary damages may be an insufficient remedy for breach of certain provisions of this Agreement and that the non-breaching party may be entitled to injunctive relief in addition to other remedies. Nothing in this Agreement shall limit a party's rights under applicable law.

IN WITNESS WHEREOF, the parties have executed this Agreement by their duly authorized representatives.

Controller:

By:

Date:

Subprocessor:

By:

Date:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What a Data Processing Subprocessor Agreement Is and when it matters

A Data Processing Subprocessor Agreement (DPSA) is a contract between a primary data processor and any third-party subprocessor appointed to process personal or sensitive data on the processor’s behalf. The DPSA defines roles, permitted processing activities, technical and organizational security measures, liability allocation, confidentiality, notification requirements for breaches, audit rights, and termination procedures. It complements the main data processing agreement and ensures contractual chains of accountability when subprocessors handle data subject records, regulated data sets, or services such as hosting, analytics, or support.

Why a DPSA protects your organization and data subjects

A well-drafted DPSA clarifies responsibility for security, incident response, and compliance obligations, reducing legal and operational risk. It documents subprocessors, limits permitted processing, mandates security controls, and preserves audit and termination rights to meet regulatory and contractual obligations.

Why a DPSA protects your organization and data subjects

Who typically needs a Data Processing Subprocessor Agreement

Use a DPSA whenever processors rely on third parties who will access or otherwise process regulated or sensitive data on their behalf.

  • Cloud and SaaS providers who delegate storage, analytics, or customer support to third parties.
  • Healthcare and life sciences organizations when PHI is accessed by service vendors (BAA generally required).
  • Financial services and payroll vendors that pass sensitive personal or account data to subcontractors.

Core clauses to include in a professional DPSA

A robust DPSA contains specific, enforceable clauses that limit risk and demonstrate compliance; each clause should be clear, measurable, and aligned with the main processor agreement.

Scope of Processing

Describe the data categories, processing purposes, and specific activities the subprocessor may perform; avoid open-ended descriptions that expand liability.

Security Measures

List technical and organizational controls (encryption, access controls, logging, vulnerability management) plus minimum standards and periodic assessment obligations.

Data Subject Requests

Define how the subprocessor will support data subject access, correction, deletion, and portability requests and the expected response timelines.

Breach Notification

Require prompt notification of security incidents, a defined notification window, investigation cooperation, and remediation obligations.

Audit and Inspection Rights

Provide the processor with the right to audit, request audit reports (SOC 2, ISO 27001), and require remediation within defined timeframes.

Subprocessor Onboarding and Flow-Down

Require prior notice or approval for subcontracting, and ensure contractual flow-down of equivalent security and compliance obligations.

Step-by-step: completing and executing a DPSA

Follow these sequential steps to prepare, review, and finalize a Data Processing Subprocessor Agreement.

  • 01
    Identify subprocessors: List all third parties that will process data and the specific services they provide.
  • 02
    Map data flows: Document where data is stored, transmitted, and accessed to set security requirements accurately.
  • 03
    Draft clauses: Insert mandatory clauses for scope, security, audit, breach notification, and termination.
  • 04
    Execute agreement: Obtain authorized signatures and record the effective date for retention and audit purposes.

Configuring an online DPSA workflow for e-signing and audits

Set up the digital workflow so document routing, signer authentication, and audit trails meet compliance needs.

Field Configuration
Signer Authentication Email + optional SMS code or SSO for stronger identity verification
Audit Trail Capture IP, timestamp, and action log for each signer
Document Versioning Enable version control to prevent unsigned or outdated copies from circulating
BAA / Agreement Attachment Attach required Business Associate Agreement when PHI is involved

Technology and platform considerations for digital DPSAs

Ensure the platform provides encryption in transit and at rest, retention controls, and exportable audit logs for inspections and regulatory requests.

  • Authentication: Email, SMS, SSO
  • File formats: PDF, DOCX
  • Integrations: CRM and storage systems

Typical routing and approval flow for a DPSA

A standard DPSA workflow includes drafting, internal review, security assessment, legal sign-off, and execution by authorized signatories.

  • Draft: Prepare DPSA with required clauses and subprocessor list.
  • Security Review: Confirm controls and obtain SOC 2 or equivalent evidence.
  • Legal Review: Validate liability, indemnity, and termination language.
  • Execution: Authorized signers sign and date; retain audit trail.

Comparing eSignature providers for executing a DPSA (vendor features and pricing)

Basic vendor pricing and feature availability relevant for signing and managing DPSAs. Confirm plan details with each provider before purchase.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies by vendor Varies by vendor Varies by vendor Varies by vendor
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No
Envelope Cap No cap 100 envelopes/user/year Varies by plan Varies by plan Varies by plan

Security and compliance facts to record in the DPSA

Encryption: TLS 1.2/1.3; AES-256 at rest
Access Control: Role-based access controls; MFA
Audit Logging: Tamper-evident logs and timestamps
Certifications: SOC 2 Type II; ISO 27001
HIPAA BAA: BAA required for PHI processing
Data Location: Specify processing and storage jurisdictions

Key legal and operational risks from an inadequate DPSA

Contractual Liability: Damages and indemnity exposure
Breach Notification: Regulatory and notification costs
Regulatory Enforcement: State privacy fines and enforcement
HIPAA Exposure: HHS civil penalties and corrective action
Data Loss: Operational disruption and reputational harm
Supply Chain Risk: Unapproved subprocessors expanding scope

Common drafting and operational pitfalls to avoid

  • Using vague processing descriptions that allow subprocessors to expand activities beyond intended purposes, increasing legal exposure.
  • Failing to list or require notice for new subprocessors; this blocks visibility and prevents timely security assessments.
  • Not including measurable security standards (e.g., SOC 2 or encryption thresholds) making audits subjective and enforcement difficult.
  • Neglecting termination and data return or deletion obligations, which complicates wind-down and compliance with data-subject requests.

Real-world examples showing how organizations use DPSAs

These brief examples show practical outcomes when processors use clear DPSAs and manage subprocessors proactively.

Optica Ventures — COO

Optica consolidated vendor agreements to include explicit subprocessor lists and security clauses.

  • Focused onboarding and audit schedules.
  • The result improved vendor visibility and reduced time spent chasing assurances during customer audits, while clarifying contractual responsibility for data handling with each subprocessor.

Fertility Centers of Illinois — Founder

A healthcare provider required BAAs and specific logging requirements from every vendor.

  • Required SOC 2 or equivalent evidence.
  • This approach helped the center maintain HIPAA compliance and ensured quick coordination with subprocessors during security reviews and patient-request audits.

Typical timelines and deadlines during DPSA processing

Establish clear internal deadlines to keep negotiation, review, and execution on schedule.

Initial Review:

Security and legal review typically 5–15 business days

Subprocessor Notice:

Require notice of new subprocessors 10–30 days before onboarding

Breach Notification Window:

Mandate prompt notification; define a specific hours/days window

Execution:

Agreement effective upon last signature and dating

Data Subject Support:

Define response SLAs for access or deletion requests

Common questions about Data Processing Subprocessor Agreements

Answers to frequent questions about enforceability, e-signatures, subprocessors, and retention for DPSAs.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.