Data Processing Addendum

Sections to be drafted

• Roles of the parties, including which party is controller and which is processor for each category of data
• Processing instructions and the scope of permitted processing
• Confidentiality obligations
• Security measures
• Subprocessors, including the authorisation model and the notice given before a change
• Assistance with data-subject requests
• Personal data breach notification
• Deletion and return of data at the end of the agreement
• Audits and the evidence that satisfies them
• International transfers and the mechanisms relied on
• Annex: categories of data subjects, categories of personal data, processing operations, duration and locations

Why this is not published

A DPA has to describe what actually happens. The subprocessor list, hosting regions, retention rules and security measures are not confirmed, so the annex cannot be completed and the clauses cannot be relied on. Publishing a skeleton would invite a business customer to treat it as an offer.

If you need a DPA now

Business customers who need a data processing agreement before this document is finalised should use the contact page and say so. The request will be handled directly rather than by pointing at an unfinished page.