Contents2 sections
Not yet executed
This staging draft is not an executed data-processing agreement. Do not submit real customer personal data until the operator identity and the processor terms are finalized and approved.
Required production agreement
The final DPA must identify controller/processor roles, subject matter, duration, nature and purpose of processing, data types and data subjects; documented instructions and confidentiality; technical/organizational measures; approved subprocessors and change notices; transfer mechanisms; assistance with rights, security incidents and impact assessments; return/deletion and backup handling; and information/audit rights. Security, retention and notification commitments must match operational evidence, not invented promises.