Is a PDPA enforceable if signed electronically?

Yes. Electronic signatures are generally enforceable in the U.S. under the ESIGN Act (15 U.S.C. ch. 96) and state UETA laws where adopted. Ensure intent, consent, attribution, and reproducible records to meet the e-sign validity test.

Do I need a Business Associate Agreement (BAA)?

If a processor handles protected health information (PHI), a HIPAA-compliant BAA is required in addition to the PDPA; the PDPA should reference the BAA and harmonize breach notification obligations (45 CFR §164.502 and §164.504).

How long must I keep signed PDPAs?

Retain signed agreements for the full term of the relationship plus applicable statutory periods; for example, HIPAA-related records require six years from creation or last effective date (45 CFR §164.530(j)).

What if state privacy laws conflict with the PDPA?

Where state privacy statutes apply (e.g., California CPRA), align contractual obligations to meet the strictest applicable requirements and seek legal advice on preemption and consumer rights.

Can subprocessors be added after execution?

Yes if the PDPA provides a process: typically prior notice and the opportunity to object, or an approval workflow; ensure flow-down terms bind subprocessors to the PDPA obligations.

How do I amend or terminate a PDPA?

Follow the amendment and termination clauses in the PDPA: provide required notice, complete any data return or secure deletion steps, and document final affidavits or certificates of destruction as specified.

Electronic Signature
Templates
Miscellaneous
Personal Data Processing Agreement

Personal Data Processing Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

PERSONAL DATA PROCESSING AGREEMENT

This Personal Data Processing Agreement (the "Agreement") is made effective as of Effective Date: by and between Data Controller: and Data Processor: .

WHEREAS

WHEREAS, the Data Controller determines the purposes and means of processing certain personal data and requires certain services from the Data Processor that involve the processing of personal data; and

WHEREAS, the Data Processor agrees to process personal data on behalf of the Data Controller in accordance with the documented instructions, applicable law, and the terms set forth in this Agreement; and

WHEREAS, the parties intend for this Agreement to govern the rights and obligations of each party with respect to the protection, security, confidentiality, and permitted uses of personal data processed under the underlying services agreement between the parties.

SCOPE OF WORK

Description of processing activities

PROCESSING DETAILS

Categories of personal data Categories of data subjects Purposes of processing Nature of processing activities Duration of processing Location(s) of processing

TECHNICAL AND ORGANIZATIONAL MEASURES

Security measures and controls Subprocessors authorized

The Data Processor may engage subprocessors subject to Controller's prior written authorization.

If applicable, list authorized subprocessors and services

DATA SUBJECT RIGHTS AND CONTROLLER INSTRUCTIONS

The Processor shall, to the extent legally permitted, promptly notify the Controller of any request from a data subject to exercise rights and shall follow the Controller's documented instructions. The Processor shall provide reasonable assistance to the Controller to enable the Controller to respond to data subject requests.

Data subject request contact

BREACH NOTIFICATION

The Processor shall notify the Controller without undue delay and, in any event, within of becoming aware of a confirmed or suspected personal data breach, providing sufficient details to enable the Controller to meet legal obligations.

Breach notification contact

AUDIT AND INSPECTION

The Processor shall make available to the Controller all information necessary to demonstrate compliance and shall permit and contribute to audits, including on-site inspections, subject to reasonable advance notice and the Processor's security and confidentiality requirements.

Audit notice period

CONFIDENTIALITY

The Processor and its personnel shall treat all personal data as confidential and shall not disclose or permit access to personal data except to authorized personnel, subcontractors subject to written obligations, or as required by law. The Processor shall ensure that any person authorized to process personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

PAYMENT TERMS

Processing fee amount Payment schedule Late payment fee

TERM AND TERMINATION

This Agreement commences on Start Date: and shall continue until End Date: unless earlier terminated in accordance with this Agreement.

Termination notice period Obligations upon termination

LIABILITY AND INDEMNITY

Each party limits its liability to the extent permitted by applicable law. The Processor shall be liable for losses arising from its breach of this Agreement, including unauthorized processing, failure to implement agreed security measures, and breaches of confidentiality. The Controller shall indemnify the Processor for liabilities resulting from Controller's instructions that are unlawful or violate applicable data protection law.

RETURN OR DELETION OF DATA

Upon termination or expiry, the Processor shall, at the Controller's option, return all personal data to the Controller or securely delete or anonymize such data within . The Processor shall certify in writing that it has complied with this obligation.

GOVERNING LAW

Applicable law

ENTIRE AGREEMENT

This Agreement, together with any referenced appendices and the underlying services agreement between the parties, constitutes the entire agreement with respect to the subject matter herein and supersedes all prior agreements and understandings relating to the processing of personal data.

IN WITNESS WHEREOF, the parties have executed this Agreement by their duly authorized representatives.

Data Controller:

By:

Date:

Data Processor:

By:

Date:

What a Personal Data Processing Agreement Is and when it applies

A Personal Data Processing Agreement (PDPA) is a contractual document that defines how a data controller and a data processor handle personal information on behalf of the controller. It allocates responsibilities for lawfulness of processing, security safeguards, permitted purposes, subprocessors, international transfers, incident response, and deletion or return of data. In U.S. contexts the PDPA supplements privacy policies and regulatory obligations (for example, state privacy laws and sector rules such as HIPAA) and helps organisations document compliance commitments and operational controls.

Why a clear PDPA matters for compliance and risk management

A PDPA clarifies roles, limits liability, and documents safeguards required by privacy laws and sector rules. It reduces ambiguity about permitted uses, supports vendor audits, and is evidence of reasonable care in the event of regulatory review or incident response.

Typical organizations and teams that use a PDPA

Organizations that collect or outsource processing of personal data commonly use a PDPA to set expectations and meet regulatory or contractual obligations.

Healthcare providers and vendors managing PHI under a BAA, ensuring HIPAA obligations are flowed and enforced.
SaaS and cloud vendors that process customer personal data as subprocessors, documenting security controls and breach notification.
Legal, finance, and HR teams that oversee third-party access to employee or taxpayer data, ensuring contractual protections and audit rights.

Small vendors and large enterprises alike use PDPAs when third parties process customer, employee, or patient data; the document is often required before services commence.

Core clauses you should expect in a professional PDPA

A robust PDPA contains several predictable sections that allocate obligations, document technical and organizational measures, and set the path for audits, breach response, and termination. Below are the six features to confirm are present and clear.

Scope of Processing

Defines data categories, processing activities, and who is controller versus processor; restricts uses to agreed purposes and products.

Security Measures

Specifies technical and organizational safeguards such as encryption, access controls, incident response, and vulnerability management responsibilities.

Subprocessors

Requires prior notice or approval for subprocessors and maps approval, flow-down terms, and liability allocation for their actions.

Breach Notification

Sets timelines for notification, information required, and coordination for regulatory reporting and mitigation steps.

Data Subject Rights

Allocates responsibility for handling access, correction, deletion, portability requests, and who bears costs for responses.

Termination and Return

Specifies return or secure deletion of data on termination, verification steps, and retention exceptions for legal holds.

Step-by-step: completing and executing the PDPA

Follow a clear sequence to reduce negotiation cycles and ensure the agreement is enforceable and operationally useful.

01

Prepare draft: Populate controller and processor details and list data categories.
02

Define controls: Add technical safeguards, audit rights, and subprocessor rules.
03

Review legal: Have counsel verify indemnities, liability caps, and governing law.
04

Execute: Signatures from authorized persons and record execution date.

How to configure an online PDPA workflow

Digital execution benefits from predefined fields, authentication, and automated routing. Configure the workflow to match your internal approvals and compliance needs.

Field	Configuration
Authentication	Email link, SMS code, or advanced signer verification
Field Types	Signature, initial, date, checkbox, conditional text fields
Conditional Logic	Show clauses or annexes only when specific options are selected
Notifications	Automatic reminders and completion receipts to stakeholders

Typical e-sign and e-submission flow for a PDPA

Most online PDPA processes follow a short sequence from upload to audit completion; align each step with your compliance checklist.

Upload document: Import the PDPA as PDF or DOCX and confirm layout.
Place fields: Add signature, date, and checkbox fields where needed.
Add signers: Assign roles and set signing order when required.
Send for signature: Deliver via email link or secure portal and capture audit trail.

Technical and integration considerations for electronic PDPA workflows

Confirm that your e-sign platform supports required authentication, compliance, and integrations before digital execution.

Authentication Options: Email, SMS, KBA, or advanced signer verification
Integrations: CRM, ERP, cloud storage and SSO (Salesforce, NetSuite, Google Workspace)
Export Formats: PDF/A, DOCX, or XML with embedded audit log

Comparing typical eSignature vendors for executing PDPAs

Selecting an eSignature provider affects cost, compliance features, and scalability. The table compares common criteria across major vendors; signNow is shown first for consistency.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day free trial	Yes, trial available	Yes, trial available	Yes, trial available	Yes, trial available
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Security and compliance items typically captured in the PDPA

Data Types: Personal identifiers, sensitive categories

Encryption: At-rest and in-transit required

Access Controls: Role-based access

Audit Logging: Timestamps and event history

Breach Response: Notification timelines

Subprocessor Policy: Approval and flow-down terms

Key risks and potential penalties from an inadequate PDPA

Regulatory Fines: Civil penalties and enforcement actions

Contract Liability: Indemnities and damages claims

Breach Costs: Notification and remediation expenses

Data Loss: Operational disruption and recovery costs

Litigation: Class actions and private suits

Reputation: Loss of customer trust and revenue

Common drafting and execution mistakes to avoid

Using vague data categories that allow the processor to expand processing beyond intended purposes and increase compliance risk.
Failing to specify security measures or audit rights, which limits the controller's ability to verify compliance and respond to incidents.
Permitting unlimited subcontracting without notice or approval, undermining control over who processes sensitive data.
Neglecting to address international transfers and applicable safeguards, which can render processing unlawful for some jurisdictions.

Real-world examples of PDPA use and integration

Examples show how organizations use PDPAs to operationalize privacy commitments and integrate execution with existing systems.

Optica Ventures LLC

Optica deployed standardized PDPAs across its vendor base to shorten onboarding and centralize controls.

The move reduced review cycles and improved auditability.
Brian Fitzgibbons, COO, reported that the standardized approach made it simpler for internal teams and external partners to comply without repeated negotiation or bespoke clauses.

Fertility Centers of Illinois

A healthcare client paired PDPAs with HIPAA BAAs and secure eSignature workflows to collect patient authorizations.

This aligned contractual obligations with technical safeguards and audit trails.
John Butler, Founder, noted the combination supported mobile and offline signing while preserving compliance and demonstrable evidence of data handling practices.

Practical recommendations for accurate and efficient PDPA management

Adopt standardized templates, map processing activities to clauses, and use digital workflows to reduce manual errors and speed execution.

Standardize language across vendors

Use consistent clause wording for security, subprocessors, and breach response to reduce negotiation time and ensure uniform obligations.

Document data flows

Maintain a record of where data is stored and transferred; link the PDPA to technical diagrams and inventories for audits.

Use electronic workflows

Capture signatures, audit trails, and completed records digitally to ensure reproducibility and faster retrieval during incident response.

Review periodically

Revisit PDPAs when laws change or when subprocessors are added, and require annual compliance attestations where appropriate.

Typical timelines and response expectations tied to PDPAs

PDPAs often include timelines for requests, breach notifications, audits, and periodic reviews; set realistic windows that align with legal requirements.

Breach Notification Window:

Specify number of days to notify controller after discovery (commonly 72–90 hours or as contractually agreed)

Data Subject Requests:

Allocate response timeframe (controller typically requires processor assistance within 30–45 days)

Audit Scheduling:

Allow reasonable notice (30 days typical) for on-site or remote audits

Annual Review:

Reassess security controls and subprocessors at least once per year

Retention Triggers:

Define retention end dates and legal hold procedures tied to termination or litigation

Key PDPA lifecycle milestones

Track execution and compliance milestones from initiation through termination to ensure obligations are met at each stage.

01

Draft and Negotiate

Controller and processor align on scope, data categories, and core safeguards.

02

Legal Review

Counsel confirms indemnities, liability caps, and choice-of-law provisions.

03

Execution

Authorized signatories execute and date the PDPA; record retention begins.

04

Ongoing Compliance

Scheduled audits, security testing, and subprocessors checks are performed.

Who typically signs a PDPA and their authority

Controller Signatory

Chief Privacy Officer or General Counsel typically signs on behalf of the controller with authority to bind the organization and accept liability allocations; they must confirm the PDPA aligns with internal policies and legal requirements.

Processor Signatory

An executive with contracting authority such as VP of Legal or Head of Compliance signs for the processor; signatory confirms operational ability to meet security obligations and subprocessors commitments.

Frequently asked questions about Personal Data Processing Agreements

Answers to common questions on enforceability, electronic signing, retention, and cross-border concerns for PDPAs in the United States.

Need help? Contact support

Is a PDPA enforceable if signed electronically?
Yes. Electronic signatures are generally enforceable in the U.S. under the ESIGN Act (15 U.S.C. ch. 96) and state UETA laws where adopted. Ensure intent, consent, attribution, and reproducible records to meet the e-sign validity test.
Do I need a Business Associate Agreement (BAA)?
If a processor handles protected health information (PHI), a HIPAA-compliant BAA is required in addition to the PDPA; the PDPA should reference the BAA and harmonize breach notification obligations (45 CFR §164.502 and §164.504).
How long must I keep signed PDPAs?
Retain signed agreements for the full term of the relationship plus applicable statutory periods; for example, HIPAA-related records require six years from creation or last effective date (45 CFR §164.530(j)).
What if state privacy laws conflict with the PDPA?
Where state privacy statutes apply (e.g., California CPRA), align contractual obligations to meet the strictest applicable requirements and seek legal advice on preemption and consumer rights.
Can subprocessors be added after execution?
Yes if the PDPA provides a process: typically prior notice and the opportunity to object, or an approval workflow; ensure flow-down terms bind subprocessors to the PDPA obligations.
How do I amend or terminate a PDPA?
Follow the amendment and termination clauses in the PDPA: provide required notice, complete any data return or secure deletion steps, and document final affidavits or certificates of destruction as specified.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now