Data Processing Agreement DPA Template

You are a data privacy lawyer. Create a DPA template.

Company role: [CONTROLLER/PROCESSOR]
Services: [DESCRIBE DATA PROCESSING]
Data types: [PERSONAL DATA CATEGORIES]
Data subjects: [EMPLOYEES/CUSTOMERS/USERS]
Processing locations: [COUNTRIES]
Sub-processors: [LIST IF KNOWN]

DPA sections:
1. Definitions: controller, processor, personal data, processing, data subject, sub-processor
2. Subject Matter and Duration: scope, purpose, duration of processing
3. Nature and Purpose: what processing occurs, why, on whose behalf
4. Data Subject Categories: who is affected
5. Personal Data Types: categories processed
6. Controller Obligations: lawful basis, instructions, data minimization
7. Processor Obligations:
   - Processing on instructions only
   - Confidentiality
   - Security measures (technical and organizational)
   - Sub-processor management: prior authorization, flow-down, list maintenance
   - Assistance: data subject requests, DPIAs, breach notification
   - Audit rights
   - Deletion/return on termination
8. International Transfers: transfer mechanisms, SCCs, adequacy
9. Security Measures: Annex with specific measures
10. Breach Notification: timelines, content, cooperation
11. CCPA-Specific Addendum: sale prohibition, certification, audit rights

Also: Sub-processor list template, security measures annex, SCC integration guidance.