What is a DPA?

A Data Processing Agreement is a contract between a Controller and a Processor that explains how personal data is handled. The Controller decides why and how personal data is used. The Processor handles that data on the Controller's behalf, for example by hosting, storing, analyzing, or supporting a service.

Laws such as the EU and UK GDPR require a written DPA when a Processor handles personal data for a Controller. The agreement sets responsibilities, security expectations, breach notification duties, and rules for subcontractors known as subprocessors.

When do you need a DPA?

• You provide a product or service that processes personal data for business customers, for example a SaaS app or managed support.
• You hire vendors who will access customer personal data, for example a cloud host or analytics platform. In that case, you are the Controller and the vendor is your Processor or subprocessor.
• Your customers ask for a GDPR-compliant contract before sharing customer records, employee information, or other personal data.

Note: If you only process data for your own company's needs and do not handle personal data on behalf of others, a DPA may not apply to those specific activities.

What does a good DPA include?

• Purpose and scope. A clear description of the services and the types of personal data being processed.
• Roles and responsibilities. A statement that the Processor acts only on documented instructions from the Controller.
• Security measures. Practical safeguards such as encryption, access control, logging, and multi-factor authentication.
• Subprocessors. Rules for using third parties, including notice and responsibility for their compliance.
• Data subject rights assistance. Help the Controller respond to access or deletion requests where required by law.
• Breach notification. Timely notice to the Controller if an incident affects personal data you handle.
• International transfers. The lawful basis for cross-border transfers where applicable.
• Return and deletion. What happens to personal data when the service ends.

How to use the DPA Generator

1. Open the tool with the button below. All fields are processed locally in your browser.
2. Enter the Controller name, your Processor name, your website, and a contact email for privacy matters.
3. List the types of personal data you handle, for example names, emails, IP addresses, and usage data.
4. Describe the purpose of processing, for example providing a SaaS service or support.
5. Summarize your security measures, for example encryption, MFA, access controls, and logging.
6. Identify any subprocessors, for example cloud hosting or payment providers.
7. Specify a sensible retention period and deletion approach after the service ends.
8. Select "Generate". Copy the output to your legal document template or download it from your site's workflow if offered.

Note: This generator provides a structured starting point. A lawyer should review your final DPA to match your exact services, jurisdictions, and risk profile.

Practical tips

• Keep a current list of subprocessors and share changes with customers when contracts require it.
• Align the DPA with your privacy notice and your technical controls so they tell the same story.
• Map data flows for common use cases. This helps you respond to customer due-diligence questions.
• Test your incident response plan and document timelines for notifying customers about security events.

FAQs

Does this tool store my inputs? No. It works entirely on the client side. Nothing is sent to a server by the generator page.

Is the generated text legally sufficient? It is a template. You should have a lawyer review and tailor it to your services and laws that apply to you.

Can I add custom clauses? Yes. Paste the generated text into your document editor and expand sections such as international transfers or audits.

Helpful references

• GDPR Article 28 on Processor requirements, including content of a DPA. See official text on EUR-Lex.
• Supervisory authority guidance on DPAs and vendor due diligence, for example UK ICO resources.
• Security control frameworks for inspiration, for example NIST SP 800-53 and ISO 27001 Annex A.