Data Processing Agreement (DPA) for GDPR Compliance

Draft a Data Processing Agreement (DPA) that complies with GDPR requirements: - Data Controller: [your company name, country] - Data Processor: [vendor/service provider name, country] - Services provided by processor: [e.g., 'Cloud hosting', 'Email marketing', 'Customer support platform'] - Types of personal data processed: [e.g., 'Name, email, IP address, purchase history'] - Data subjects: [e.g., 'EU customers, website visitors, employees'] - Processing purposes: [e.g., 'Order fulfillment, marketing communications, analytics'] The DPA should include: 1. **Definitions** — Personal data, processing, controller, processor, sub-processor, data subject, supervisory authority 2. **Subject Matter & Duration** — Scope of processing, tied to main service agreement 3. **Nature & Purpose of Processing** — What the processor does with the data and why 4. **Obligations of the Processor:** - Process only on documented instructions - Confidentiality obligations for personnel - Security measures (Article 32 — technical and organizational) - Sub-processor management (prior written consent, flow-down obligations) - Data subject rights assistance (Articles 15-22) - Breach notification (72-hour requirement) - Data Protection Impact Assessment assistance - Return or deletion of data upon termination 5. **International Data Transfers** — Standard Contractual Clauses reference, adequacy decisions, supplementary measures 6. **Audit Rights** — Controller's right to audit, process, frequency 7. **Liability** — Allocation between controller and processor 8. **Annexes:** - Annex 1: Details of processing (categories, subjects, duration, nature) - Annex 2: Technical and organizational security measures - Annex 3: List of approved sub-processors Use GDPR article references throughout.