Can an agreement be signed electronically?

Yes. Electronic signatures are generally enforceable under federal ESIGN and state UETA laws for most commercial agreements, provided the parties manifest intent and the record is retained in a reproducible form.

Is a BAA required for health data?

If the agreement covers protected health information, include or execute a Business Associate Agreement as required under HIPAA; a BAA sets specific safeguards and breach obligations.

What if a signer lacks authority?

Confirm signatory authority prior to reliance by obtaining a corporate resolution, power of attorney, or an attestation clause within the agreement identifying delegated signers.

When should security attestations be requested?

Request SOC 2 reports, penetration-test summaries, or other technical evidence during vendor onboarding and at regular intervals thereafter as part of contractual audit rights.

How long must executed agreements be kept?

Retain executed agreements for the active contract term plus additional years to meet federal and industry retention rules and to support potential dispute or regulatory review.

Can terms be modified after signing?

Amendments require mutual written agreement; use change orders or amendment documents signed by authorized representatives and retain execution records for auditability.

Electronic Signature
Templates
Legal
Data Security Agreement

Data Security Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA SECURITY AGREEMENT

This Data Security Agreement (the "Agreement") is entered into as of Effective Date: by and between Client Name: , with principal place of business at (hereinafter "Data Owner"), and Service Provider Name: , with principal place of business at (hereinafter "Service Provider"). Each of Data Owner and Service Provider is a "Party" and together the "Parties."

RECITALS

WHEREAS, Data Owner possesses certain Confidential Information and Personal Data that may be processed, stored, accessed or transmitted in connection with the services to be provided by Service Provider; and

WHEREAS, Service Provider will process such data on behalf of Data Owner and requires contractual commitments regarding security, confidentiality, breach notification, and permitted uses; and

WHEREAS, the Parties desire to set forth the security, confidentiality and data handling requirements applicable to such data processing.

NOW, THEREFORE, in consideration of the mutual covenants contained herein and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:

1. DEFINITIONS

1.1 "Confidential Information" means all non-public information disclosed by one Party to the other, whether oral, written or electronic, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.

1.2 "Personal Data" means any information relating to an identified or identifiable natural person that is provided to or collected by Service Provider in connection with the services described in this Agreement. Categories of Personal Data to be processed include:

1.3 "Security Incident" means any confirmed or reasonably suspected unauthorized access to, acquisition, use, disclosure, modification, or destruction of Personal Data or information systems that may materially compromise the confidentiality, integrity or availability of Personal Data.

2. SCOPE OF PROCESSING

Service Provider shall process Personal Data only on documented instructions from Data Owner, for the purposes described as: and for no other purpose absent prior written authorization from Data Owner. Any additional processing requested by Service Provider must be approved in writing by Data Owner.

3. SECURITY CONTROLS

3.1 Service Provider shall implement and maintain administrative, technical and physical safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, including measures addressing: access control, asset management, encryption, secure development, logging and monitoring, vulnerability management, and incident detection.

3.2 Encryption: Service Provider shall ensure that Personal Data is encrypted in transit and at rest using encryption standards equivalent to industry best practices. Encryption required: Yes

3.3 Authentication and Access: Service Provider shall enforce least privilege access, unique credentials, timely revocation of access upon termination or role change, and multi-factor authentication for accounts with administrative privileges.

4. SUBPROCESSORS

4.1 Service Provider shall not engage any subprocessor to process Personal Data without Data Owner's prior written consent. Where consent is given, Service Provider shall impose data protection obligations on subprocessors that mirror those in this Agreement, remain liable for subprocessor performance, and provide Data Owner an opportunity to object to any proposed subprocessor.

Approved Subprocessors (if any):

5. INCIDENT RESPONSE AND NOTIFICATION

5.1 Upon becoming aware of a Security Incident affecting Personal Data, Service Provider shall promptly take measures to contain, investigate and remediate the incident and shall notify Data Owner without undue delay and, in any event, within hours of discovery. The notification shall include, to the extent known, a description of the incident, categories and approximate number of affected data subjects, data elements affected, measures taken and planned corrective actions.

5.2 Service Provider shall cooperate with Data Owner in fulfilling any legal or regulatory obligations related to the Security Incident, including providing reasonable assistance with communications to affected individuals and regulators.

6. AUDITS AND RECORDS

6.1 Upon reasonable notice, Service Provider shall make available to Data Owner all information necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including independent third-party audits, subject to confidentiality protections. Audit rights shall be exercised no more than unless otherwise required by law or reasonable suspicion of noncompliance.

Audit Contact (Service Provider):

7. RETURN OR DESTRUCTION OF DATA

Upon expiration or termination of the services, Service Provider shall, at Data Owner's choice, return all Personal Data to Data Owner and certify destruction of any copies, or securely destroy all Personal Data, within days, except to the extent applicable law requires retention, in which case Service Provider shall isolate and protect retained data from further processing and notify Data Owner of the legal requirement.

8. CONFIDENTIALITY

Each Party shall maintain the confidentiality of Confidential Information of the other Party and shall not disclose such information except to those employees, contractors or agents with a legitimate need to know who are bound by confidentiality obligations at least as protective as those in this Agreement. Obligations of confidentiality survive termination of this Agreement for a period of five (5) years, or longer as required by applicable law for Personal Data.

9. LIABILITY AND INDEMNIFICATION

9.1 Service Provider shall indemnify, defend and hold harmless Data Owner from and against any losses, liabilities, damages, fines, penalties and reasonable costs (including attorneys' fees) arising from Service Provider's breach of this Agreement, negligence, willful misconduct, or failure to comply with applicable data protection laws.

9.2 Except for liability resulting from a Party's willful misconduct or breach of confidentiality or Personal Data obligations, neither Party's aggregate liability shall exceed the greater of the amounts paid or payable by Data Owner to Service Provider under the relevant statement of work in the twelve (12) months preceding the claim.

Required Cyber Liability Insurance Amount:

10. TERM AND TERMINATION

This Agreement commences on the Effective Date and continues for the term of the underlying services or until terminated by either Party for material breach that remains uncured for thirty (30) days after written notice. Termination does not relieve either Party of obligations accrued prior to termination, including indemnification and data return or destruction obligations.

11. NOTICES

Notices under this Agreement shall be in writing and delivered to the addresses below by certified mail, courier, or electronic delivery to an authorized representative.

Notices to Data Owner: Notices to Service Provider:

12. GOVERNING LAW; MISCELLANEOUS

12.1 Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its conflict of law principles.

12.2 Entire Agreement: This Agreement, together with any written exhibits or statements of work expressly incorporated herein, constitutes the entire agreement between the Parties with respect to the subject matter and supersedes all prior or contemporaneous understandings.

12.3 Amendments and Waiver: No amendment, modification or waiver of any provision of this Agreement shall be effective unless in writing and signed by both Parties. The waiver of any breach shall not constitute a waiver of any other breach.

12.4 Severability: If any provision of this Agreement is held invalid, illegal or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect and the Parties shall negotiate in good faith a substitute provision that comes closest to the Parties' intent.

12.5 Counterparts: This Agreement may be executed in counterparts, each of which will be deemed an original and all of which together will constitute one and the same instrument.

SIGNATURES

Data Owner

Printed Name:

By:

Date:

Service Provider

Printed Name:

By:

Date:

What a Data Security Agreement Is and when it applies

A Data Security Agreement is a legal contract that sets out how one party will protect, handle, store, and return or destroy another party's sensitive information. It defines permitted uses, access controls, encryption and breach-notification obligations, and allocation of liability for security incidents. These agreements are commonly used between vendors, service providers, and customers when personal data, regulated health information, financial records, or confidential business information are exchanged. The document supplements broader contracts such as master services agreements or HIPAA business associate agreements when required.

Why a Data Security Agreement matters for risk and compliance

A Data Security Agreement clarifies responsibilities, reduces legal exposure after a breach, and demonstrates contractual due diligence to regulators and customers. It supports compliance with U.S. frameworks such as ESIGN/UETA for execution and industry rules like HIPAA for health data, and it documents technical and organizational safeguards required by the parties.

Organizations and roles that commonly use Data Security Agreements

Use a Data Security Agreement whenever data access, processing, storage, or cross-border transfer could create compliance obligations or material business risk.

Cloud and SaaS providers with access to customer data, where contractual safeguards reduce operational and regulatory risk.
Healthcare vendors handling PHI who require explicit privacy and security obligations to support a BAA.
Financial institutions and payment processors subject to GLBA and PCI obligations when sharing consumer financial information.

Core clauses to include in a professional Data Security Agreement

A comprehensive agreement combines operational, legal, and technical provisions so each party understands security expectations and remedies.

Scope of Data

Precisely identify categories of data covered (PII, PHI, financial, trade secrets), permitted processing activities, and any excluded data to avoid ambiguity.

Security Controls

List required safeguards such as encryption in transit and at rest, access controls, vulnerability management, patching timelines, and logging practices.

Breach Notification

Define notification timelines, content, escalation contacts, and cooperation obligations for investigation and remediation after a suspected or confirmed breach.

Audit and Assessment

Allow for security assessments, penetration testing, SOC reports, or third-party audits, including frequency and scope limitations and remediation timelines.

Data Return and Deletion

Specify actions at contract end: secure return or certified deletion of data, timelines, and verification methods for data destruction.

Liability and Indemnity

Allocate liability limits, indemnification for regulatory fines or third-party claims, and carve-outs for gross negligence or willful misconduct.

Essential information to capture in the agreement

Parties: Full legal names

Data Types: Categories of covered data

Purpose: Permitted processing purpose

Duration: Effective and end dates

Breach Contacts: Designated incident contacts

Jurisdiction: Governing law selection

Step-by-step: preparing and executing a Data Security Agreement

Follow these sequential steps to create, review, and finalize the agreement with minimal friction and clear legal effect.

01

Draft: Compile scope, controls, and breach terms.
02

Legal Review: Have counsel verify compliance and liability language.
03

Operational Review: Security and privacy teams confirm technical feasibility.
04

Execution: Sign with authorized representatives and retain audit logs.

How to configure an online signing workflow for this agreement

Set up a clear digital workflow that assigns roles, authentication, and retention before sending the agreement for signature.

Field	Configuration
Signer Order	Define sequential or parallel signing based on approval flow
Authentication	Choose email link, SMS code, or stronger identity verification
Attachment Requirements	Require certificates, SOC reports, or evidence as needed
Retention Settings	Enable audit trail storage and export to secure repository

Where to send and how to submit the executed agreement

Decide destinations and recipients for signed copies and records to ensure compliance and easy retrieval.

Primary Recipient: Legal or contracting team email and secure folder
Security Team: Send to CISO or data protection officer
Vendor Portal: Upload executed copy to vendor management system
Archive: Store final PDF and audit trail in document repository

Technical considerations for eSigning and eSubmission

Select a platform that can produce tamper-evident PDFs, retain an auditable certificate of completion, and export records for legal or compliance review.

Authentication Options: Email, SMS, KBA, or SSO
Document Formats: PDF and DOCX supported
Integrations: CRM, ERP, cloud storage

Key timelines and processing expectations

Track critical deadlines related to notification, audits, and retention so obligations are met and regulatory risk is reduced.

Execution Timeline:

Target execution before data exchange or project start

Breach Notification:

Set internal notification windows consistent with regulator expectations

Audit Frequency:

Plan annual or more frequent security assessments

Retention Start:

Retention typically begins on the effective date

Termination Actions:

Define timeframe for data return or certified deletion

Common penalties and legal risks when the agreement is incorrect

Regulatory Fines: Possible fines for noncompliance

Contractual Liability: Indemnity and damage awards

Breach Costs: Investigation and remediation expenses

Reputation Harm: Loss of customers and partners

Operational Disruption: Service suspension or remediation mandates

Litigation Exposure: Class actions or third-party suits

Real-world examples of how organizations use Data Security Agreements

Practical examples show common clause selections and operational workflows used by actual companies.

Optica Ventures LLC

Optica required a vendor to implement encryption and access logging as a condition of onboarding

Vendor provided SOC 2 report and enabled audit logging
Optica retained audit evidence and used contractual indemnity to clarify liability, which streamlined remediation after a minor incident.

Fertility Centers of Illinois

The center added explicit PHI handling and BAA references to third-party imaging providers

Providers agreed to technical safeguards and breach notification timelines
The strengthened agreement reduced uncertainty and ensured coordinated incident response across partners.

Who can legally sign a Data Security Agreement

Authorized Corporate Officer

An officer or manager with contracting authority should sign. Confirm authority via corporate resolution or a delegation-of-signature document when doubt exists.

Data Protection Officer

A DPO or similarly authorized privacy lead may sign if granted contracting authority; otherwise signatory must be an authorized legal or executive representative.

Common mistakes to avoid when preparing the agreement

Vague data definitions that fail to specify categories or formats cause interpretation disputes and enforcement gaps.
Relying on generic security language without measurable controls makes audits and compliance verification difficult.
Missing authority check where signatory lacks corporate approval leads to contract voidability or delay.
Failing to align breach notification timelines with regulatory obligations can increase regulatory exposure.

Practical tips for accurate, efficient agreement completion

Adopt standard templates, require verification steps, and integrate signing workflows with security and vendor-management systems.

Use a Master Template

Start from a vetted template that includes core clauses and append industry-specific exhibits to reduce drafting time and legal review cycles.

Limit Scope Narrowly

Define precise data categories and permitted activities to reduce ambiguity and limit obligations to what is operationally required.

Require Evidence

Mandate delivery of security attestations such as SOC 2 reports, penetration test summaries, or encryption certificates when onboarding vendors.

Automate Recordkeeping

Store executed PDFs and audit trails in a secure repository with searchable metadata to speed audits and incident investigations.

Comparing eSignature vendors for executing Data Security Agreements

Key vendor capabilities influence cost, compliance, and operational fit; signNow appears first to reflect available plan and compliance details.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about Data Security Agreements

Answers to common legal, operational, and technical questions encountered when preparing and executing a Data Security Agreement.

Need help? Contact support

Can an agreement be signed electronically?
Yes. Electronic signatures are generally enforceable under federal ESIGN and state UETA laws for most commercial agreements, provided the parties manifest intent and the record is retained in a reproducible form.
Is a BAA required for health data?
If the agreement covers protected health information, include or execute a Business Associate Agreement as required under HIPAA; a BAA sets specific safeguards and breach obligations.
What if a signer lacks authority?
Confirm signatory authority prior to reliance by obtaining a corporate resolution, power of attorney, or an attestation clause within the agreement identifying delegated signers.
When should security attestations be requested?
Request SOC 2 reports, penetration-test summaries, or other technical evidence during vendor onboarding and at regular intervals thereafter as part of contractual audit rights.
How long must executed agreements be kept?
Retain executed agreements for the active contract term plus additional years to meet federal and industry retention rules and to support potential dispute or regulatory review.
Can terms be modified after signing?
Amendments require mutual written agreement; use change orders or amendment documents signed by authorized representatives and retain execution records for auditability.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now