Data Processing Agreement (US)
Parties
This agreement is dated the date on which it is signed by the last of the parties.
This agreement is made between [Controller legal name and details] (the "Controller") and [Processor legal name and details] (the "Processor").
Key Terms
"Agreement" means [Underlying agreement].
"Security Policy" means the Processor's written information security program, which must include at least access controls based on least privilege with multi-factor authentication for administrative and remote access, encryption of Controller Personal Data in transit and at rest, logging and monitoring, vulnerability management and patching, backups and tested recovery, an incident response plan, personnel screening and training, and annual independent testing.
Definitions
"Applicable Laws" means the laws, rules, regulations, court orders, and other binding requirements of a relevant government authority that apply to or govern a party.
"Applicable Data Protection Laws" means the Applicable Laws that govern how the Service may process or use an individual's personal information, personal data, personally identifiable information, or other similar term, including, where they apply, the California Consumer Privacy Act of 2018 and its regulations (the "CCPA") and other US state consumer privacy laws.
"Controller Personal Data" means Personal Data that the Controller provides or makes available to the Processor, or that the Processor collects on the Controller's behalf, as part of the Service and that is governed by this DPA.
"DPA" means this data processing agreement, including its schedules.
"Personal Data" will have the meaning(s) given in the Applicable Data Protection Laws for personal information, personal data, or other similar term.
"Processing" or "Process" will have the meaning(s) given in the Applicable Data Protection Laws for any use of, or performance of a computer operation on, Personal Data, including by automatic methods.
"Report" means audit reports prepared by another company according to the standards defined in the Security Policy on behalf of the Processor.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Controller Personal Data, including any event that is a breach of the security of a system under Applicable Laws.
"Service" means the products and services the Processor provides under the Agreement.
"Sensitive Data" means Personal Data that is sensitive personal information, sensitive data, special category data or a similar term under Applicable Data Protection Laws.
"Subprocessor" means any person the Processor engages to Process Controller Personal Data.
"Business purpose", "consumer", "contractor", "sell", "service provider", "share" and similar terms have the meanings given in Applicable Data Protection Laws.
"EEA SCCs" means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council; "EEA" means the member states of the European Union, Norway, Iceland and Liechtenstein; and "GDPR" means Regulation (EU) 2016/679.
"UK GDPR" has the meaning given in the UK Data Protection Act 2018; "UK Addendum" means the International Data Transfer Addendum to the EEA SCCs issued under section 119A of the UK Data Protection Act 2018; and "UK IDTA" means the International Data Transfer Agreement issued under that section; in each case as current from time to time.
"Restricted Transfer" means (a) where the GDPR applies, a transfer of personal data from the EEA to a country outside the EEA that is not subject to an adequacy decision of the European Commission; (b) where the UK GDPR applies, a transfer of personal data from the United Kingdom to a country or organization not approved by regulations under Article 45A of the UK GDPR; and (c) where the Swiss Federal Act on Data Protection of 25 September 2020 (the "FADP") applies, a transfer of personal data from Switzerland to a country that the Swiss Federal Council has not recognized as providing an adequate level of protection.
Roles
Where the Controller is a controller (or, under the CCPA, a business) of Controller Personal Data, the Processor is its processor and, where the CCPA applies, its service provider or contractor. Where the Controller is itself a processor of Controller Personal Data for another controller, the Processor is its Subprocessor and the Controller's instructions include those it receives from that controller.
Processing
Processing Details. The Processing Details schedule describes the subject matter, nature, specific business purposes and duration of the Processing, the categories of Personal Data and of data subjects, and any Sensitive Data and its safeguards. The Controller discloses Controller Personal Data to the Processor only for those limited and specified business purposes.
Processing Instructions. The Controller instructs the Processor to Process Controller Personal Data: (a) to provide and maintain the Service; (b) as may be further specified through the Controller's use of the Service; (c) as documented in the Agreement; and (d) as documented in any other written instructions given by the Controller and acknowledged by the Processor about Processing Controller Personal Data under this DPA. The Processor will abide by these instructions unless prohibited from doing so by Applicable Laws. The Processor will promptly inform the Controller if it is unable to follow the instructions or believes an instruction infringes Applicable Data Protection Laws. The Controller has given and will only give instructions that comply with Applicable Laws.
Changes to Processing. The Processor will only Process Controller Personal Data in accordance with this DPA. If the Processor updates the Service, it may propose changes to the Processing Details schedule to reflect the update by written notice to the Controller. A change that is not material takes effect 30 days after the notice unless the Controller objects in writing within that period, in which case it takes effect only if the parties agree it in writing. Any other change, including one that adds a new business purpose or new categories of Personal Data, data subjects or Sensitive Data, takes effect only with the Controller's prior written agreement.
Controller as Processor. Where the Controller is a processor and the Processor is a Subprocessor, the Controller will comply with all Applicable Laws that apply to its Processing of Controller Personal Data, its agreement with its controller will similarly require it to comply with Applicable Laws, and it will comply with the subprocessor requirements in that agreement.
Controller Compliance. The Controller has complied with and will continue to comply with all Applicable Data Protection Laws concerning its provision of Controller Personal Data to the Processor and the Service, including making all disclosures, obtaining all consents, providing adequate choice (including honoring opt-outs), and implementing relevant safeguards required under Applicable Data Protection Laws.
Changes to Applicable Data Protection Laws
The parties will work together in good faith to negotiate an amendment to this DPA as either party reasonably considers necessary to address the requirements of Applicable Data Protection Laws from time to time.
Restrictions on Use
The Processor must not: (a) sell or share Controller Personal Data; (b) retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes in the Processing Details schedule or as Applicable Data Protection Laws otherwise permit; (c) retain, use or disclose it outside the direct business relationship between the Processor and the Controller; or (d) combine it with personal information the Processor receives from or on behalf of anyone else, or collects from its own interactions with consumers, except as Applicable Data Protection Laws permit.
California Terms
The Processor certifies that it understands and will comply with the Restrictions on Use clause. It must comply with the CCPA and its regulations as they apply to it and provide the same level of privacy protection to Controller Personal Data as the CCPA requires of businesses. It must notify the Controller promptly after it determines that it can no longer meet those obligations. The Controller may take reasonable and appropriate steps to ensure the Processor uses Controller Personal Data consistently with the Controller's CCPA obligations, including manual reviews, automated scans and assessments, audits or other testing at least once every 12 months, and, on notice, to stop and remediate any unauthorized use.
Confidentiality
The Processor must ensure that each person who Processes Controller Personal Data is subject to a duty of confidentiality and has access only as needed to provide the Service.
Security
The Processor must implement and maintain reasonable security procedures and practices appropriate to the nature of Controller Personal Data, including the Security Policy, to protect it from unauthorized or illegal access, destruction, use, modification, or disclosure. The Processor may update the Security Policy, provided no update materially reduces the overall protection of Controller Personal Data.
Subprocessors
The Processor will not give any Controller Personal Data to a Subprocessor unless the Controller has approved it. The Approved Subprocessors schedule lists each Subprocessor's identity, location and anticipated Processing tasks and is approved by signing this DPA. The Processor will inform the Controller in writing at least 10 business days in advance of any intended addition or replacement, with the information the Controller needs to object. The Controller may object within that period; otherwise it is deemed to accept the change. If it objects, the parties will cooperate in good faith to resolve the objection, and if they cannot, the Controller may terminate the affected Service without penalty.
When engaging a Subprocessor, the Processor will have a written contract with it that binds it to obligations no less protective than this DPA, including the Restrictions on Use clause, and to the requirements of Applicable Data Protection Laws for subcontractors. If the GDPR applies, the contract will impose the Article 28(3) obligations described in this DPA. On request, the Processor will share a copy of the relevant terms, which it may redact to protect business secrets or other confidential information. The Processor remains fully liable for all obligations subcontracted to its Subprocessors, including their acts and omissions in Processing Controller Personal Data, and will notify the Controller of any failure by a Subprocessor to fulfill a material obligation about Controller Personal Data.
Restricted Transfers
Authorization. The Controller agrees that the Processor may transfer Controller Personal Data outside the EEA, the United Kingdom, or Switzerland as necessary to provide the Service. If the Processor makes a Restricted Transfer, it will implement appropriate safeguards consistent with Applicable Data Protection Laws.
EEA SCC Completion. Wherever the parties are deemed to have signed the EEA SCCs under this DPA, including as supplemented by the UK Addendum or for transfers from Switzerland, they are completed as follows: (a) Module Two applies where the Controller is a controller and Module Three where it is a processor; (b) the optional docking clause in Clause 7 does not apply; (c) in Clause 9, Option 2 applies with the notice period in the Subprocessors clause, or Option 1 where that clause requires the Controller's prior approval; (d) in Clause 11, the optional language does not apply; (e) in Clause 13, all square brackets are removed; (f) in Clause 17, Option 1 applies with the laws of Ireland; (g) in Clause 18(b), disputes are resolved in the courts of Ireland; and (h) the Processing Details schedule, the Security Policy and the Approved Subprocessors schedule contain the information required in Annexes I to III.
Ex-EEA Transfers. If the GDPR protects a transfer of Controller Personal Data from the Controller in the EEA to the Processor outside the EEA, the transfer is a Restricted Transfer and the Processor's Processing is not itself subject to the GDPR, then by entering into this DPA the parties are deemed to have signed the EEA SCCs and their Annexes, which are incorporated by reference and completed as set out in the EEA SCC Completion provisions of this clause.
Ex-UK Transfers. If the UK GDPR protects a transfer of Controller Personal Data from the Controller in the United Kingdom to the Processor outside it, and the transfer is a Restricted Transfer, then by entering into this DPA the parties are deemed to have signed the UK Addendum, which is incorporated by reference, together with the EEA SCCs it supplements, completed as set out in the EEA SCC Completion provisions of this clause; the schedules to this DPA provide the information required in the UK Addendum's tables. Neither party is selected in Table 4 of the UK Addendum, so neither may end it under its Section 19, but if a revised version is issued the parties will work in good faith to adopt it. If the parties instead sign the UK IDTA for a transfer, the UK IDTA applies to that transfer in place of the UK Addendum. The party exporting the data must carry out any assessment UK law requires, including whether the data protection test in Article 46 of the UK GDPR is met, with the other party's reasonable help.
Swiss Transfers. If the FADP protects a transfer of Controller Personal Data from the Controller in Switzerland to the Processor outside it, and the transfer is a Restricted Transfer, then by entering into this DPA the parties are deemed to have signed the EEA SCCs for that transfer, to the extent they have not already done so, completed as set out in the EEA SCC Completion provisions of this clause and adapted as the Swiss Federal Data Protection and Information Commissioner (the "FDPIC") requires for standard contractual clauses it recognizes under Article 16(2)(d) of the FADP: (a) so far as the transfer is subject to the FADP, references to the GDPR are to be read as references to the FADP, and the FDPIC is the competent supervisory authority under Clause 13 and in Annex I.C, alongside any EEA supervisory authority where the GDPR also applies to the transfer; and (b) the term "member state" in the EEA SCCs must not be read so as to prevent data subjects habitually resident in Switzerland from bringing claims in Switzerland under Clause 18(c).
Security Incident Response
On becoming aware of any Security Incident, the Processor will: (a) notify the Controller without undue delay and in any event within 72 hours, or any shorter period Applicable Laws require; (b) provide timely information about the Security Incident as it becomes known or as the Controller reasonably requests; and (c) promptly take reasonable steps to contain and investigate it. The Processor will not notify affected individuals or regulators about a Security Incident without the Controller's approval unless Applicable Laws require it. Its notification of or response to a Security Incident is not an acknowledgment of fault or liability.
Controller Security Responsibilities
The Controller is responsible for reviewing the information made available by the Processor relating to data security and making an independent determination as to whether the Service meets the Controller's requirements and legal obligations under Applicable Data Protection Laws. The Controller is solely responsible for complying with Security Incident notification laws applicable to it and fulfilling any obligations to give notices to government authorities, affected individuals or others relating to any Security Incidents.
Audit & Reports
Audit Rights. The Processor will give the Controller all information reasonably necessary to demonstrate its compliance with this DPA and will allow for and contribute to reasonable assessments, audits and inspections by the Controller or its designated assessor. The Controller will first rely on any Report and on the security due diligence responses described below; an on-site audit may take place, no more than once a year on at least 30 days' notice, where those materials do not reasonably demonstrate compliance, after a Security Incident, or where Applicable Data Protection Laws require. Audits must avoid unreasonable disruption and follow the Processor's reasonable security and confidentiality requirements. The Processor will keep records of its compliance with this DPA for 3 years after the DPA ends.
Security Reports. The Processor is regularly audited against the standards defined in the Security Policy by independent third-party auditors. On written request, it will give the Controller, on a confidential basis, a summary copy of its then-current Report so that the Controller can verify its compliance with those standards.
Disclosure of Reports to Authorities
The Controller may share a copy of any Report with relevant government authorities as required upon their request.
Audit & Reports
Security Due Diligence. In addition to any Report, the Processor will respond to the Controller's reasonable written requests for information to confirm its compliance with this DPA, including information security, due diligence and audit questionnaires, made to [Processor security contact] no more than once a year, or more often after a Security Incident.
The Processor will maintain records of its compliance with this DPA for 3 years after this DPA ends.
Coordination & Cooperation
Response to Inquiries. If the Processor receives any inquiry or request from anyone else about the Processing of Controller Personal Data, including a request from a consumer or data subject or a judicial, administrative or regulatory order, it will notify the Controller where Applicable Law permits and will not respond without the Controller's prior consent. Where allowed, it will follow the Controller's reasonable instructions about these requests. The Processor will enable the Controller to comply with consumer and data subject requests under Applicable Data Protection Laws, including requests to know, correct, delete or opt out, and will comply with any such request the Controller passes to it. It will cooperate with and reasonably assist the Controller, at the Controller's expense, in any legal response to a third-party request about the Processing.
Assessments. Where Applicable Data Protection Laws require, the Processor will provide the information and reasonable assistance the Controller needs for data protection assessments, risk assessments, cybersecurity audits, transfer impact assessments, automated decision-making requirements and consultations with authorities, taking into account the nature of the Processing.
Deletion of Controller Personal Data
Deletion during the Service. The Processor will enable the Controller to delete Controller Personal Data in a manner consistent with the functionality of the Service and will comply with a deletion instruction as soon as reasonably practicable, except where Applicable Law requires further storage.
Deletion when the DPA ends. Within 30 days after this DPA ends, the Processor will return or delete Controller Personal Data at the Controller's instruction, unless Applicable Law requires further storage, in which case the Processor will continue to protect the retained data and Process it only for the purpose requiring storage. On request, the Processor will certify deletion, including the certification described in Clause 8.5 of the EEA SCCs where they apply.
Limitation of Liability
Liability Caps and Damages Waiver. To the maximum extent permitted under Applicable Data Protection Laws, each party's total cumulative liability to the other party arising out of or related to this DPA will be subject to the waivers, exclusions, and limitations of liability stated in the Agreement.
Related-Party Claims. Any claims made against the Processor or its affiliates arising out of or related to this DPA may only be brought by the Controller entity that is a party to the Agreement.
Exceptions. This DPA does not limit any liability to an individual about the individual's data protection rights under Applicable Data Protection Laws, or any liability between the parties for violations of the EEA SCCs, the UK Addendum or the UK IDTA.
Conflicts Between Documents
This DPA forms part of and supplements the Agreement. If there is any inconsistency between this DPA, the Agreement, or any of their parts, the part listed earlier will control over the part listed later for that inconsistency: (1) the EEA SCCs, the UK Addendum or the UK IDTA, (2) this DPA, and then (3) the Agreement.
Term of Agreement
This DPA starts on its date and continues until the Agreement expires or is terminated. However, the Processor and the Controller will each remain subject to the obligations in this DPA and Applicable Data Protection Laws until the Controller stops transferring Controller Personal Data to the Processor and the Processor stops Processing it.
Governing Law
This DPA is governed by the law that governs the Agreement, and disputes under it are resolved in the forum the Agreement specifies. If the Agreement specifies neither, this DPA is governed by the laws of the State of Delaware, without regard to conflict of laws rules, and the state and federal courts located in the State of Delaware have exclusive jurisdiction. This does not affect the governing law and forum the EEA SCCs, the UK Addendum or the UK IDTA require.
Processing Details
Specific business purposes and nature of the Processing: [Specific business purposes and nature of processing]. Categories of Personal Data: [Categories of Personal Data]. Categories of data subjects: [Categories of Data Subjects]. Sensitive Data: none. Restrictions or safeguards for Sensitive Data: not applicable. Frequency of transfer: continuous for the term of the Agreement. Duration: the term of the Agreement and any later period until Controller Personal Data is deleted or returned. Controller privacy contact: [Controller privacy contact]. Processor security contact: [Processor security contact].
Approved Subprocessors
Approved Subprocessors at the date of this DPA (identity, location and anticipated Processing tasks): none.
Artificial Intelligence and Automated Processing
The Processor will not use Controller Personal Data to train, fine-tune, develop or improve any artificial intelligence or machine learning model, whether its own or a third party's, unless (a) that use is reasonably necessary to provide the Service in accordance with the Controller's documented instructions, or (b) the Controller has expressly authorized it in writing. The Processor will prohibit its Subprocessors, including any providers of artificial intelligence models, from using Controller Personal Data for their own model training, fine-tuning, development or improvement, except as the Controller expressly authorizes in writing. If the Service involves automated decision-making that produces legal or similarly significant effects on individuals, including any significant decision for which Applicable Data Protection Laws regulate the use of automated decisionmaking technology, the Processor will: (a) disclose that processing to the Controller; (b) to the extent reasonably available to it, provide meaningful information about the logic involved, without being required to disclose its trade secrets or confidential information; and (c) reasonably cooperate with the Controller, as Applicable Data Protection Laws require, to enable individuals to exercise their rights relating to automated decision-making.