A data processing agreement your clients can sign.
If you handle personal data on behalf of clients, Privacyboard drafts a data processing agreement from your answers: your subprocessors, how clients authorize them, the notice you give and the time to report a breach. You review it, then validate it.
Free to set up · No credit card · About 5 minutes
In short
- When
- Only if you process personal data for clients
- Built from
- Your vendors, activities and the terms you choose
- Terms you set
- Subprocessor authorization, notice period, breach reporting time
- Output
- A draft to validate, download or show in your center
Set the terms once
Choose how subprocessors are authorised, how much notice you give and how fast you report a breach.
Subprocessors from your vendor list
The list in the agreement comes from the vendors you already documented, so it never drifts.
Validate, then share
Validate a version and show it to clients from your privacy center, or download it for a contract.
What is a data processing agreement?
A data processing agreement, or DPA, is the contract the GDPR requires between a controller and a processor. If a client decides why and how personal data is used and you process it for them, you are the processor, and the contract sets what you may do with that data.
Clients regularly ask for a DPA during onboarding or a security review. Having a clear one ready, with your real subprocessors listed, shortens those conversations. Privacyboard asks you once whether you process data for clients and drafts the agreement only if the answer is yes.
How it works
- 1
Say if you process for clients
One question decides whether you need a DPA. If you do not, nothing is added to your workspace.
- 2
Set your terms
Choose how clients authorize subprocessors, the notice you give about new ones and how fast you report a breach.
- 3
Review and validate
Your vendors are listed as subprocessors. Read the draft, adjust it and validate it. Download it or share it from your privacy center.
What you get
Asked once, drafted when needed
The agreement exists only when you process data on behalf of clients.
Your real subprocessors
The vendors you serve clients with, with their purpose and region, appear in the subprocessor section.
Terms in your words
Choose general or specific authorization of subprocessors, a notice period in days and a breach report time in hours.
Transfers handled
If a subprocessor processes data outside the EEA, the draft asks how the transfer is protected.
Checked for gaps
A checklist shows what is missing before you can validate, such as a subprocessor without a region.
Ready to share
Download the validated agreement or show it in your privacy center for clients to find.
What Article 28 requires in the contract
The draft is a starting point. A negotiated or high-risk contract should be reviewed by a professional.
- Article 28(3)
- The contract sets the subject matter, duration, nature and purpose of processing, the type of data and categories of people, and the obligations and rights of the controller.
- Documented instructions
- The processor acts only on the controller's documented instructions, keeps data confidential, secures it, helps with people's requests and deletes or returns data at the end.
- Articles 28(2) and 28(4)
- Subprocessors need the controller's authorization, specific or general, and are bound by the same obligations.
- Article 33(2)
- A processor must notify the controller of a breach without undue delay.
Questions, answered.
Who needs a data processing agreement?
Any company that processes personal data on behalf of another company, such as a software provider handling its clients' customer data. If you only use data for your own purposes, you do not need to offer one, though the providers you use may need one with you.
Is a DPA mandatory?
Yes. Article 28 requires a binding contract between a controller and a processor that includes specific terms. A signed DPA is the usual way to meet that.
What are the terms I can set?
How clients authorize your subprocessors, the notice period for new ones in days, and the time within which you report a breach to the client, in hours.
Is the draft ready to sign?
It is a starting point built from your answers. Read it, adjust it to your situation and validate it. For a negotiated or high-stakes contract, ask a professional to review it.
Do I need to list my subprocessors?
Yes. Clients are entitled to know which subprocessors you use. The draft lists the vendors you marked as serving clients, with their purpose and region.
Is the DPA part of the free plan?
Yes. Drafting and validating are free. Showing it in a public privacy center needs Pro.