# Data processing agreement template for a small B2B team Page: https://askmystartup.com/answers/data-processing-agreement-template Author: Karthik Idikuda, founder of AskMyStartup Last updated: 2026-10-21 Enterprise customers ask for a DPA before they sign. A short DPA template with blanks lets you fill it in once, send it with confidence, and stop negotiating the same clauses every deal. A template with blanks, not legal advice. Rules on pay, leave and data vary by state, so check yours. ## The template ### Parties and scope - Controller: [customer legal name], [address]. - Processor: [your company legal name], [address]. - This DPA covers personal data processed by the processor on behalf of the controller under the service agreement dated [date]. ### Processing details - Subject matter: [what the service does, e.g., customer support platform, HR software]. - Duration: for the term of the service agreement and until all personal data is deleted or returned. - Nature and purpose: [providing the service, analytics, support, billing]. - Categories of data subjects: [customers, employees, end users]. - Categories of personal data: [name, email, usage data, payment data, [other]]. ### Processor obligations - Process only on documented instructions from the controller. - Ensure persons authorized to process are bound by confidentiality. - Implement appropriate technical and organizational measures (see security annex). - Do not engage a sub processor without the controller's prior written consent (general or specific). - Assist the controller with data subject rights, breach notification, and impact assessments. - Delete or return all personal data at the controller's choice after the service ends. - Make available information to demonstrate compliance and allow audits on reasonable notice. ### Sub processors - Current sub processors: [list with name, service, location]. - The processor will notify the controller of any new sub processor at least [number] days before engagement. - The controller may object to a new sub processor within [number] days on reasonable grounds. ### International transfers - If personal data leaves [the US / the EU / India], the transfer relies on [standard contractual clauses / adequacy decision / other mechanism]. - Copies of the safeguards are available at [link or on request]. ### Security annex - Encryption in transit: TLS 1.2 or higher. - Encryption at rest: AES 256 for databases and backups. - Access control: role based, least privilege, multi factor authentication for admin access. - Incident response: breach notified to controller within [number] hours of awareness. - Annual security review and penetration test by [internal team / third party]. ### Data subject rights - The processor will assist the controller to fulfill access, rectification, erasure, restriction, portability and objection requests within [number] days. - The controller handles all direct data subject communications. ### Breach notification - The processor will notify the controller without undue delay, and in any event within [number] hours, after becoming aware of a personal data breach. - The notification will describe the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken. ### Term and termination - This DPA ends when the service agreement ends. - On termination, the processor deletes or returns all personal data within [number] days and certifies deletion in writing. ### Who owns this DPA - Owner: [name]. Last confirmed: [date]. Check again by: [date], and whenever the service agreement or privacy laws change. ## The ten questions people ask 1. What is a data processing agreement? (answer to write: A contract clause or addendum that sets the processor's obligations when processing personal data on a controller's behalf, required by GDPR, CCPA and other privacy laws.) 2. Do I need a DPA if I am a small US company? (answer to write: Yes, if you process personal data for enterprise customers, especially EU or UK customers, or if your customers require it for their compliance.) 3. What is the difference between controller and processor? (answer to write: The controller decides why and how personal data is processed (your customer). The processor processes on the controller's behalf (you).) 4. Which sub processors do I list? (answer to write: Every third party that processes personal data for your service: cloud hosting, email, analytics, payments, AI providers, support tools.) 5. What if I use Anthropic or OpenAI for AI features? (answer to write: List them as sub processors with the service they provide and the data they receive. Check their DPA terms.) 6. How long do I have to notify a breach? (answer to write: GDPR says without undue delay and where feasible within 72 hours. CCPA has similar expectations. Pick a number you can meet.) 7. Can I use standard contractual clauses for international transfers? (answer to write: Yes, the EU standard contractual clauses (2021 version) are the most common mechanism. Attach them or link to them.) 8. What security measures are required? (answer to write: Appropriate technical and organizational measures. The template includes a baseline; adjust to what you actually do.) 9. Who owns the data after the contract ends? (answer to write: The controller. The processor must delete or return it and certify deletion.) 10. Is this DPA template legal advice? (answer to write: No. It is a template with blanks. Check with a lawyer for your jurisdiction and your customers' requirements before you use it.) ## Check before you publish it - Check with a lawyer for your jurisdiction and read your customers' DPA requirements before you publish. Rules differ by state and country. - List only the sub processors you actually use. Do not copy a generic list. - Test your bot or FAQ with the ten questions before you rely on it. ## Questions and answers Q: What is a DPA and when do I need one? A: A data processing agreement is required whenever a processor handles personal data on behalf of a controller. Most enterprise deals require it before signing. Q: Can I use one DPA for all customers? A: You can use the same template, but each customer may ask for changes. Keep a master version and track each customer's signed version. Q: Is this DPA template legal advice? A: No. It is a starting point with blanks. Privacy laws vary by jurisdiction and your customers may have specific requirements. Check with a lawyer.