[ LEGAL ]
Data Processing Agreement
v2026.05-draft · 2026-05-20
Parties
Controller: [controller]
Processor: [processor]
Subject matter
[scope_of_processing]
Categories of data
[data_categories]
Sub-processors
Authorised sub-processors: [subprocessors]. Processor provides 30-day prior notice of additions; Controller may object on reasonable grounds.
International transfers
Transfers outside the EEA/UK use: [transfer_mechanism].
Security measures
Processor maintains encryption at rest (per-tenant KMS), least-privilege IAM, audit logging, and annual control testing aligned to SOC 2 Type II roadmap.
Breach notification
Processor notifies Controller without undue delay and within 24 hours of becoming aware of a personal-data breach.
Placeholders: controller, processor, scope_of_processing, data_categories, subprocessors, transfer_mechanism
Template text — counsel review before production. Questions: [email protected]