Data Processing Agreement (DPA) Generator — GDPR Article 28
Generate a GDPR / UK GDPR data processing agreement between a controller and a processor, with all the Article 28(3) terms — instructions, confidentiality, security, sub-processors, assistance, deletion and audits — plus processing details annex.
For general information only — not legal advice. Laws vary by location; consult a qualified lawyer.
How to use
- 1Enter the controller and processor.
- 2Describe the processing (subject matter, data types, data subjects, duration).
- 3List sub-processors and security measures, then sign.
Frequently asked questions
Is this DPA legally binding?
A document like this is binding when the parties agree to it (and sign where required). Whether each clause is enforceable depends on your local law, so have important agreements reviewed by a lawyer.
When do I need a DPA?
Whenever a business (controller) uses another business (processor) to process personal data on its behalf — for example a SaaS tool, payroll provider or email service. GDPR Article 28 requires a written contract.
What about international transfers?
If the processor or sub-processors are outside the UK/EEA without an adequacy decision, add the EU Standard Contractual Clauses (and the UK Addendum). This template references them but doesn't include their full text.
Is my information stored?
No. The document is generated in your browser and nothing you type is sent to our servers.