Free Commercial & IP generator
Data Processing Addendum (DPA)
An addendum that governs how a vendor processes personal data on your behalf, mapped to the current U.S. multi-state privacy patchwork and carrying subprocessor, security, and breach-notice terms.
What is a Data Processing Addendum?
A Data Processing Addendum (DPA) is an addendum that governs how a vendor processes personal data on your behalf. It is mapped to the current U.S. multi-state privacy patchwork and carries subprocessor, security, and breach-notice terms.
Any company whose vendor, or whose own service, processes personal data on behalf of a customer. The CCPA/CPRA and the growing set of state privacy laws require or expect one, and enterprise customers often demand one.
Data Processing Addendum template, current for 2026
Written to the ~20-state patchwork of comprehensive privacy laws (CCPA/CPRA plus VA, CO, CT, and the newer laws) rather than only GDPR, with explicit service-provider/processor obligations, a no-sale/no-share/no-cross-context-advertising commitment, a no-AI-training-on-personal-data clause, sensitive-data handling, subprocessor flow-down, and a 72-hour breach-notice standard.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Data Processing Addendum as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- Effective date of this Addendum The date the DPA takes effect. Usually the same date as the underlying services agreement or the date of last signature.
- The customer (data controller / business) The party whose personal data is being processed. This is you, or your client, on whose behalf the vendor processes data.
- The vendor (data processor / service provider) The vendor that processes personal data on the customer's behalf. This is the party bound to the security, subprocessor, and breach-notice obligations.
- Name of the underlying services agreement this Addendum supplements The DPA hangs off a main contract. Identify it so the terms are properly incorporated and the DPA controls on data-protection conflicts.
- Describe the services the vendor provides that involve processing personal data Scopes the processing. This becomes the description of the 'business purpose' and bounds what the vendor is permitted to do with the data.
- Which U.S. state privacy laws should this Addendum be mapped to? Select every state where residents' data may be processed. Each adds specific defined terms and obligations (e.g. CCPA 'service provider' terms, VCDPA processor duties).
- Categories of personal data to be processed Defines the scope of covered data. Listing categories bounds the vendor's authority and supports records-of-processing obligations.
- Will the vendor process any sensitive personal data? Sensitive data (SSNs, precise geolocation, health, biometrics, racial/ethnic origin, etc.) triggers heightened restrictions and, in several states, consent requirements.
- Specify the categories of sensitive personal data Identifies the heightened-risk data so the corresponding controls and consent duties can attach.
- Categories of data subjects Identifies whose data is processed, relevant to consumer-rights request handling and records.
- Does the vendor operate a website, app, or other consumer-facing interface as part of the Services? If the vendor runs a consumer-facing interface, it may need to detect and honor browser-based opt-out preference signals such as the Global Privacy Control (GPC). This adds a cooperation hook so those signals reach you.
- May the vendor engage subprocessors? Controls the vendor's ability to hand data to downstream vendors, and on what notice or consent basis. General authorization with a notice-and-object window is the market standard.
- Advance notice period before adding a new subprocessor (days) How many days' notice the vendor must give before onboarding a new subprocessor, giving you a window to object. 10 to 30 days is typical.
- Deadline for the vendor to notify you of a security breach (hours) Sets the outer limit for breach notification so you can meet your own statutory deadlines. 48 to 72 hours is common; 'without undue delay' is the floor.
- Required security certifications or frameworks (optional) If you want the vendor to obtain and maintain specific certifications or framework conformance, list them here. Leave blank to require only reasonable safeguards and periodic assessment.
- Minimum cyber-liability insurance limit, in USD (optional) If you want to require the vendor to carry cyber and privacy liability insurance, set the minimum per-claim and aggregate limit. Leave blank to omit an insurance covenant.
- What audit mechanism should apply? How you verify the vendor's compliance. On-site audits are strongest but heaviest; reliance on third-party reports (SOC 2, ISO 27001) is the common middle ground. Both options carry Colorado's independent-assessor cooperation language.
- At termination, should the vendor delete or return the data? Sets the end-of-life disposition of personal data. 'Customer's choice' is most protective; some vendors default to deletion.
- Days after termination to complete deletion or return The window for the vendor to return or destroy data after the services end. 30 to 90 days is typical.
- Will personal data be processed or stored outside the United States? Cross-border processing pulls in additional transfer controls and disclosure duties even under U.S. law.
- Countries or regions where data may be processed Discloses the transfer footprint so appropriate safeguards can be flagged for review.
- Data-localization restrictions (optional) If certain data must stay within specified countries or regions, list the data and the permitted locations. Leave blank if no localization restriction applies.
- Is any EU/EEA, UK, or other GDPR-scoped personal data in scope? If the vendor will process personal data subject to the EU or UK GDPR, this adds an international-transfer section incorporating the EU Standard Contractual Clauses (Decision 2021/914, Modules 2 and 3) and the UK IDTA/Addendum, and attaches transfer annexes. If you keep this US-only, the document adds a scope note saying EU/UK data needs a separate transfer addendum.
- In the transfer, is the customer the controller of the EU/UK data, or itself a processor for another controller? Determines which EU SCC module applies. If the customer is the controller, Module 2 (controller to processor) governs; if the customer is itself a processor for a third-party controller, Module 3 (processor to processor) governs. Choose 'both' to keep the flexible controller/processor drafting.
- May the vendor use the data to train or improve AI/ML models? The Addendum prohibits using personal data or derived deidentified/aggregated data to train, fine-tune, or improve any AI/ML model except solely to provide the Services to you, and bars using it to develop the vendor's or any third party's products or models. This confirms that default; select 'service-only' to keep the strict covenant.
- Governing law (state) The state law governing interpretation of the Addendum itself. Often matches the underlying agreement.
- How should liability under this Addendum relate to the underlying agreement? Controls whether DPA liability rides the main contract's cap or is treated separately. Riding the main cap is most common.
- Standalone liability cap amount (USD) The dedicated cap for data-protection claims if you chose a separate cap.
Frequently asked
About the Data Processing Addendum and how HDAi works.
What is a Data Processing Addendum (DPA)? +
A Data Processing Addendum (DPA) is an addendum that governs how a vendor processes personal data on your behalf. It is mapped to the current U.S. multi-state privacy patchwork and carries subprocessor, security, and breach-notice terms. It is for any company whose vendor, or whose own service, processes personal data on behalf of a customer. The CCPA/CPRA and the growing set of state privacy laws require or expect it, and enterprise deals often demand it.
Is HDAi's Data Processing Addendum (DPA) legally binding? +
Once it is completed, reviewed, and properly signed, the Data Processing Addendum (DPA) HDAi generates is a binding, professionally drafted agreement. To have a licensed Hart David Carson attorney finish it, book a planning call. The firm's flat-fee packages, the Illinois Family Plan and Company Launch, cover the most common needs, and for any other draft an Illinois attorney will tell you on the call what finishing it would involve.
Do I need a lawyer to use this Data Processing Addendum (DPA)? +
You can generate and download the Data Processing Addendum (DPA) in minutes, free of charge. A licensed Hart David Carson attorney can then review it and tailor it to your facts before you sign, which is the part no template can do.
What makes this Data Processing Addendum (DPA) current for 2026? +
Written to the ~20-state patchwork of comprehensive privacy laws (CCPA/CPRA plus VA, CO, CT, and the newer laws) rather than only GDPR, with explicit service-provider/processor obligations, a no-sale/no-share/no-cross-context-advertising commitment, a no-AI-training-on-personal-data clause, sensitive-data handling, subprocessor flow-down, and a 72-hour breach-notice standard.
How long does the Data Processing Addendum (DPA) take? +
Estimated time about 14 min (28 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Data Processing Addendum (DPA) work in my state? +
HDAi's interview is state-aware. If you ask an attorney to finish the draft, a licensed Hart David Carson attorney confirms it against your state's requirements before you rely on it. Validity and required formalities vary by state.
Commercial & IP
Related generators
SaaS Subscription Agreement · Reseller / Referral Agreement · IP Assignment Agreement · Software License Agreement (with AI / Model-Training Clause) · All 124 →