• Who decides, and the limits

  The customer decides what is handled and why, the supplier acts only on written instructions and agrees not to sell, share, combine or train a model on it unless recorded.

• What information is involved

  A table for whose information, what kinds, anything sensitive, why it is handled, what is done with it and how long it is kept.

• Security, people and others involved

  Measures agreed and reviewed, access for those who need it, and consent and notice before adding or replacing anyone else.

• Where it is held, requests and incidents

  Locations and no moves without consent, passing on requests from individuals, and telling the customer of incidents within a time you write in.

• Audits and deletion

  Records and audit rights, authority demands, and return or deletion at the end, including backups, with confirmation.

A data processing agreement records what a supplier may do with personal information it handles on a customer's behalf while providing a service. The customer decides what is handled and why; the supplier acts on written instructions. It covers security, staff, others involved, where data is held, requests from the people concerned, incidents, audits, authority demands and deletion at the end.

This blank form is completed by hand and signed by customer and supplier. It does not make a business compliant with any privacy or data-protection law, and it says neither party relies on it as advice about what is required. What a law requires of a business depends on the data, the business and where the people are, so take advice. The form has blanks for transfers between countries and tells the parties to take their own advice on what is needed.

Not sure? Talk to an attorney about your situation first.

These are separate documents, for different jobs.

• Data-protection agreementsSet how personal data is protected between parties.View document
• SaaS agreementsSet the terms customers use your software service on.View document
• Privacy policiesExplain how you collect and use people's personal data.View document
• Cybersecurity legal supportLegal help with security obligations and incidents.View document

• A business engages a cloud provider to host customer records
• A supplier agrees how it will report an incident
• A customer sets which sub-suppliers may be used

• Software development agreementsSet the terms for building software for a client.View document
• SaaS agreementsSet the terms customers use your software service on.View document
• Software licensing agreementsSet the terms others can use your software on.View document
• Website terms and conditionsThe rules visitors agree to when using your website.View document