Are electronic signatures valid on a DPA?

Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. §7001) and in UETA-adopting states when intent, consent, attribution, and record retention are satisfied.

When is a BAA required?

A Business Associate Agreement is required when the processor creates, receives, maintains, or transmits protected health information on behalf of a HIPAA-covered entity; include HIPAA obligations and breach timelines.

Do subprocessors need separate agreements?

Yes. The DPA should require flow-down provisions to subprocessors or prior notice and approval so the controller retains contractual control over permitted processing.

Is notarization ever required for a DPA?

Not typically. Notarization is usually unnecessary for DPAs unless state law or a specific counterparty requires notarized execution for corporate authorization.

How long should records be retained?

Retention depends on legal obligations: IRS rules (3 years), HIPAA (6 years), SEC or industry rules may require longer; specify and cite applicable periods in the DPA.

What if a state has different rules?

Apply the chosen governing law in the DPA but ensure the agreement complies with mandatory state requirements; consult counsel for conflicts between state rules and contract terms.

Electronic Signature
Templates
Legal
Legal Data Processing Agreement

Legal Data Processing Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

LEGAL DATA PROCESSING AGREEMENT

This Data Processing Agreement (the "Agreement") is entered into as of by and between Controller Name: , an entity organized as Corporation LLC Other, with principal place of business at , and Processor Name: , an entity organized as Corporation LLC Other, with principal place of business at .

RECITALS

WHEREAS, Controller determines the purposes and means of processing Personal Data submitted to Processor in connection with Controller's business operations and services;

WHEREAS, Processor provides services that involve the processing of Personal Data on behalf of Controller and agrees to process such Personal Data in accordance with Controller's documented instructions and applicable data protection laws;

WHEREAS, the parties desire to set forth the terms and conditions under which Processor will process Personal Data for Controller to ensure appropriate technical and organizational measures and contractual protections;

NOW THEREFORE, in consideration of the mutual covenants contained herein and other good and valuable consideration, the parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is provided by or on behalf of Controller to Processor under or in connection with this Agreement.

1.2 "Processing" has the meaning given in applicable data protection law and includes any operation or set of operations performed on Personal Data, whether or not by automated means.

1.3 "Subprocessor" means any natural or legal person appointed by Processor to process Personal Data on behalf of Controller.

2. SUBJECT-MATTER, DURATION, NATURE AND PURPOSE

2.1 Subject-matter: The subject-matter of Processing under this Agreement is the Personal Data provided to Processor by Controller in connection with the services described in the underlying service agreement or order form.

2.2 Duration: The term of Processing shall commence on the effective date above and continue for the term of the underlying services unless earlier terminated pursuant to this Agreement.

2.3 Purpose: Processor shall process Personal Data only to perform the services and for no other purposes except as required by law, subject to Section 3 (Instructions).

3. INSTRUCTIONS; ROLE OF PARTIES

3.1 Controller acts as Data Controller and instructs Processor to process Personal Data solely for the documented purposes set forth in this Agreement and applicable task orders. Processor shall not process Personal Data for its own purposes.

3.2 Processor shall follow Controller's documented instructions. Any additional processing requested by Controller that materially alters the scope or nature of processing requires prior written agreement and may require amendments to this Agreement.

4. PROCESSING OF PERSONAL DATA

4.1 Types of Personal Data:

4.2 Categories of Data Subjects:

5. PROCESSOR OBLIGATIONS; SECURITY

5.1 Confidentiality: Processor shall ensure that personnel authorized to process Personal Data are subject to confidentiality obligations and have received appropriate training.

5.2 Technical and organizational measures: Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration or disclosure. Controller may request a summary description of such measures.

Security Measures (describe or attach summary)

6. SUBPROCESSORS

6.1 Appointment: Controller hereby authorizes Processor to engage Subprocessors to carry out specific processing activities. Processor shall enter into a written contract with each Subprocessor imposing data protection obligations no less protective than those in this Agreement.

6.2 Notice: Processor shall provide Controller with prior notice of any intended addition or replacement of Subprocessors and a reasonable opportunity to object where required by applicable law.

Authorized Subprocessors (list)

7. INTERNATIONAL TRANSFERS

7.1 Processor will not transfer Personal Data outside the country or jurisdictions specified by Controller without Controller's prior written consent. Where transfers occur, Processor shall implement appropriate safeguards required by applicable data protection laws.

8. DATA SUBJECT RIGHTS

8.1 Assistance: Taking into account the nature of processing and the information available to Processor, Processor shall reasonably assist Controller by implementing appropriate technical and organizational measures to enable Controller to respond to data subject requests to exercise their rights under applicable law.

8.2 Notification: Processor shall promptly notify Controller if it receives a request, complaint or other communication from a data subject relating to the processing of Personal Data.

9. INCIDENT RESPONSE AND BREACH NOTIFICATION

9.1 Security incidents: Processor shall notify Controller without undue delay and, where feasible, within seventy-two (72) hours after becoming aware of a confirmed or suspected security incident affecting Personal Data and shall provide sufficient information to enable Controller to comply with its obligations to supervisory authorities and data subjects.

Incident Contact (Processor)

10. AUDIT AND RECORDS

10.1 Records: Processor shall maintain records of processing activities carried out on behalf of Controller and make available to Controller information necessary to demonstrate compliance with this Agreement.

10.2 Audit: Controller shall have the right to conduct audits or inspections, subject to reasonable notice and confidentiality obligations. Where audits are frequent or intrusive, parties agree to mutually acceptable procedures and cost sharing.

11. RETURN OR DELETION

Upon termination or expiration of the underlying services, Processor shall, at Controller's choice, return all Personal Data to Controller or securely delete or destroy all Personal Data in Processor's possession, unless retention is required by law. Processor shall certify deletion upon Controller's written request.

12. LIABILITY AND INDEMNIFICATION

12.1 Liability: Each party's liability arising under this Agreement shall be subject to the limitations and exclusions set forth in the underlying service agreement, except liability arising from a party's gross negligence, willful misconduct, or breach of confidentiality and data protection obligations.

12.2 Indemnification: Processor shall indemnify and hold harmless Controller from third-party claims resulting from Processor's breach of this Agreement, Processor's negligent or willful misconduct, or Processor's failure to implement required safeguards.

13. NOTICES

All notices under this Agreement shall be in writing and delivered to the addresses set forth below or to such other address as either party may designate by notice in accordance with this provision.

Controller Notice Address Processor Notice Address

14. GOVERNING LAW; DISPUTE RESOLUTION

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified by Controller: , without regard to conflict of laws principles. The parties shall attempt in good faith to resolve disputes amicably prior to initiating formal legal proceedings.

15. ENTIRE AGREEMENT; SEVERABILITY; AMENDMENTS

15.1 Entire Agreement: This Agreement, together with any underlying service agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings regarding such subject matter.

15.2 Severability: If any provision of this Agreement is held to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall remain in full force and effect.

15.3 Amendments: Any amendment to this Agreement must be made in writing and signed by authorized representatives of both parties. No course of dealing, usage of trade, or failure to enforce any provision shall modify this Agreement.

16. MISCELLANEOUS

16.1 Waiver: Failure by either party to enforce any provision of this Agreement shall not constitute a waiver of that provision or the right to enforce such provision later.

16.2 Counterparts: This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one instrument.

SIGNATURES

The parties, through their authorized representatives, have executed this Agreement as of the date first written above.

Controller Printed Name:

By:

Date:

Processor Printed Name:

By:

Date:

What a Legal Data Processing Agreement is and why it matters

A Legal Data Processing Agreement (DPA) is a contract between a data controller and a data processor that defines how personal data will be handled, protected, and used. It allocates responsibilities for data security, subject access requests, breach notification, subprocessors, retention, and permitted purposes. In the United States a DPA often references HIPAA, ESIGN/UETA for electronic records and signatures, and contract law principles; regulators expect clear operational details and breach response procedures. This document supports compliance, reduces regulatory risk, and documents technical and organizational safeguards agreed by the parties.

Why include a DPA in your contracting lifecycle

A DPA clarifies legal roles, reduces regulatory exposure under HIPAA or sector rules, documents security measures, and establishes obligations for breach notification, audits, and subprocessors.

Who commonly prepares or signs a Legal Data Processing Agreement

Organizations with regulated data and their vendors should use a DPA to document responsibilities before processing begins.

Healthcare providers and vendors handling PHI, where HIPAA requires contractual safeguards and a BAA.
Cloud and SaaS vendors that store or process personal information for business customers.
Legal, HR, and payroll providers that access sensitive employee or client records.

The DPA is a precondition for many integrations and is often negotiated alongside master services agreements or statements of work.

Typical signatories and their roles

Vendor Authorized Signatory

A senior representative with authority to commit the processor (for example, VP of Legal or COO). This person confirms the processor's security controls and accepts obligations such as subprocessors, breach notifications, and audit cooperation.

Customer Data Controller

A corporate officer or procurement lead who can bind the controller. The signatory defines permitted processing purposes, retention limits, and the legal basis for processing, and may require audit rights or security reports.

Essential security and compliance items to list in the DPA

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Access Controls: Role-based access and MFA for privileged users

Audit Trail: Immutable logs with timestamps and user IDs

Breach Notification: Specific timelines and contact points

Subprocessor Policy: Listing, prior notice, and objection rights

Data Residency: Location commitments and export rules

Key risks and contractual remedies to include

Regulatory fines: Potential HIPAA or state privacy penalties

Breach costs: Notification, forensics, and remediation expenses

Contract termination: Right to suspend or terminate processing

Indemnification: Liability allocation for third-party claims

Reputational harm: Market and client trust consequences

Data loss: Business interruption and recovery costs

Common drafting pitfalls to avoid

Vague processing descriptions that do not specify purpose, categories of data, or retention periods.
Missing subprocessors clause or absence of a process to notify and approve third-party processors.
No technical detail on encryption, access controls, or breach-response timelines.
Failing to align choice-of-law or jurisdiction clauses with operational realities and regulatory obligations.

How organizations use a DPA in real scenarios

Representative cases show how DPAs reduce ambiguity and document compliance steps across industries.

Optica Ventures (Healthcare vendor)

The vendor signed a DPA with a hospital to define PHI handling

DPA required a BAA and annual penetration testing
As a result the parties eliminated repeated ad hoc security requests and documented a faster breach escalation path to meet HIPAA timelines.

Xerox (Enterprise integration)

NetSuite integration required a DPA to permit payroll data transfers

The DPA specified encryption and audit rights
The agreement streamlined vendor onboarding and reduced legal review cycles for subsequent integrations.

Step-by-step: completing a Legal Data Processing Agreement

Follow these steps to prepare, negotiate, and finalize a DPA that aligns with regulatory and operational needs.

01

Identify parties: List controller, processor, and contact details
02

Define processing: Specify purpose, data categories, and retention
03

Set security controls: Document encryption, access, and logging
04

Agree remediation: Define breach notice, audit, and termination rights

Typical operational flow after DPA execution

A DPA should map to practical steps so teams know how to act when processing begins or an incident occurs.

Onboarding: Exchange contacts, security questionnaires, and scope
Operational monitoring: Implement logging and periodic reviews
Subprocessor updates: Notify and obtain objections if required
Incident handling: Invoke breach plan and notify controller promptly

Core clauses every professional DPA should include

These clauses form the foundation of a DPA and are typically negotiated up front; they should be clear, measurable, and enforceable.

Processing scope

Purpose, categories of personal data, and specific processing activities the processor may perform on behalf of the controller.

Security measures

Technical and organizational controls, encryption standards, access controls, incident management, and testing commitments.

Subprocessors

Approval process for subprocessors, listing obligations, and rights to object or require flow-down terms.

Breach notification

Specific notification timelines, required content, and cooperation obligations for forensic analysis and remediation.

Audit and inspection

Controller rights to audit, frequency limits, and acceptable methods including third-party reports such as SOC 2 Type II.

Data return and deletion

Obligations at termination for data return, secure deletion, and certification of destruction where applicable.

Practical drafting tips to reduce negotiation friction

Adopt clear, specific language and use measurable security standards to limit ambiguity and reduce back-and-forth during negotiation.

Use standard benchmarks where possible

Reference established standards (for example, SOC 2 Type II or ISO 27001) instead of bespoke technical lists that are hard to verify.

Limit audit scope and frequency

Specify a reasonable audit cadence, acceptable documentation (e.g., SOC 2 reports), and a process for on-site inspections only when justified.

Define breach timelines

Set concrete notification windows and required information to avoid disputes and to meet regulatory obligations promptly.

Automate subprocessor updates

Require periodic lists and automated notifications to streamline approval and reduce manual contract amendments.

Key milestones from negotiation to operational processing

Use milestones to coordinate legal, security, and operations teams and to track progress from contract signature to live processing.

01

Contract draft ready

Initial DPA draft circulated to legal teams for review and redlines

02

Security review completion

Security team verifies controls and accepts or requests remediation

03

Final sign-off

Authorized signatories execute the DPA and related statements

04

Go-live

Processing begins under the agreed DPA terms and monitoring starts

Timing considerations and standard response windows

Establish explicit timelines for common actions to meet regulatory and operational expectations.

Breach notification window:

Notify controller promptly and without undue delay, typically within 72 hours where applicable

Subprocessor notice:

Provide at least 30 days' prior notice for new subprocessors unless emergency processing is required

Audit notice period:

Allow 14–30 days' notice before inspections or document requests

Data return timeframe:

Return or delete data within 30–90 days after termination unless retention is required by law

Security remediation:

Agree on remediation windows (for example, 30 days for medium severity issues)

Recommended online workflow settings for executing a DPA

Configure signing workflows to capture intent, consent, and attribution while preserving an auditable trail for compliance.

Field	Configuration
Signature field	Require signer name, date, and IP/timestamp audit
Authentication	Email link plus optional SMS or KBA for higher assurance
Document versioning	Lock final version and store audit trail with all revisions
Retention setting	Archive signed copy with tamper-evident storage and exportable logs

Technical considerations for e-signing and storing DPAs

Choose platforms that provide robust audit trails, secure storage, and compliance attestations relevant to your industry.

Integrations supported: Salesforce, NetSuite, Google Workspace
File formats: PDF, DOCX, and exportable audit logs
Authentication options: Email, SMS, KBA, and SSO

Ensure the platform can produce a tamper-evident signed PDF with an audit certificate and supports any required data residency or BAA arrangements.

Representative eSignature pricing and feature comparison for DPAs

Compare vendor starter pricing and core features relevant to executing and managing DPAs. Pricing reflects published plan entry points and common capabilities.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about Legal Data Processing Agreements

Answers to common questions on enforceability, signatures, and practical implementation for DPAs in U.S. contexts.

Need help? Contact support

Are electronic signatures valid on a DPA?
Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. §7001) and in UETA-adopting states when intent, consent, attribution, and record retention are satisfied.
When is a BAA required?
A Business Associate Agreement is required when the processor creates, receives, maintains, or transmits protected health information on behalf of a HIPAA-covered entity; include HIPAA obligations and breach timelines.
Do subprocessors need separate agreements?
Yes. The DPA should require flow-down provisions to subprocessors or prior notice and approval so the controller retains contractual control over permitted processing.
Is notarization ever required for a DPA?
Not typically. Notarization is usually unnecessary for DPAs unless state law or a specific counterparty requires notarized execution for corporate authorization.
How long should records be retained?
Retention depends on legal obligations: IRS rules (3 years), HIPAA (6 years), SEC or industry rules may require longer; specify and cite applicable periods in the DPA.
What if a state has different rules?
Apply the chosen governing law in the DPA but ensure the agreement complies with mandatory state requirements; consult counsel for conflicts between state rules and contract terms.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now