GDPR-compliant agreement under Art. 28 GDPR for the processing of personal data by third parties with provisions on binding instructions, TOMs, and sub-processing.
Legally sound document structure
Clear definitions and terms
Proper signature fields
Audit trail and timestamp
Select this template or upload your own document
Enter all required information
Send the signing link to all parties
Everyone signs digitally - done!
A DPA is mandatory under Art. 28 GDPR whenever personal data is processed by external service providers, e.g., cloud hosting, email marketing, payroll processing, or IT support.
Subject matter and duration of processing, nature and purpose, data categories, categories of data subjects, processor obligations, technical and organizational measures (TOMs), and sub-processor provisions.
Missing DPAs can result in fines of up to 10 million euros or 2% of annual global turnover (Art. 83(4) GDPR). Both parties may also be liable to data subjects for damages.