Adam Frankel
General Counsel · Technology & AI
15+ years as General Counsel to technology, cloud & AI companies
Data Processing Agreement (DPA) - standard by Common Paper
Ssean-sorrekUpdated 17 Oct 2025
This Data Processing Agreement (DPA) template is designed to supplement an underlying agreement between a Customer and a Provider, detailing their respective responsibilities for processing personal data. It includes provisions for subprocessors, security contacts, and compliance with various data protection laws such as GDPR, CCPA, and international data transfer mechanisms. The template outlines key terms and standard clauses for managing personal data processing activities.
Using this DPA
This DPA has 2 parts:
The Key Terms on this Cover Page
The Common Paper DPA Standard Terms Version 1 posted at [commonpaper.com/standards/data-processing-agreement/1.0/](https://commonpaper.com/standards/data-processing-agreement/1.0/) (“DPA Standard Terms”) which is incorporated by reference.
If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this Agreement. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.
Key Terms
The key legal terms of the DPA are as follows:
Agreement
This DPA supplements the [name & date of underlying agreement].
Approved Subprocessors
- [ x ] List of Subprocessors available at [insert URL]
- [ ] [Subprocessor name]
- Country of location: [list of all countries]
- Anticipated Processing task: [text box]
Provider Security Contact
[Email and/or physical address]
Security Policy
- [ x ] As defined in the Agreement.
- [ ] Provider will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering.
- [ ] Security Policy available at [insert URL of where to find]
- [ ] Provider will maintain annually updated reports or annual certifications of compliance with the following:
- [ ] ISO 27001
- [ ] Penetration testing
- [ ] SOC 2 Type I
- [ ] PCI Level 1
- [ ] SOC 2 Type II
- [ ] PCI Level 2
- [ ] HIPAA
- [ ] FedRAMP Authorized
- [ ] Other: [fill in]
Changes to the Agreement
DPA Covered Claim
- [ ] [Select if using Common Paper CSA:] The Agreement includes an additional Provider Covered Claim for any action, proceeding, or claim arising out of or relating to [(1) Provider’s breach or alleged breach of the DPA or (2) Provider’s gross negligence or willful misconduct in each case that results in a Security Incident.]
- [ ] [Select if not using Common Paper CSA:] Without limiting the indemnity obligations in the Agreement, if any, Provider will indemnify, defend, and hold harmless Customer from and against any action, proceeding, or claim made by someone other than Customer, Customer’s Affiliates, or Users, and all out-of-pocket damages, awards, settlements, costs, and expenses, including reasonable attorneys’ fees and other legal expenses that arise from [(1) Provider’s breach or alleged breach of the DPA or (2) Provider’s gross negligence or willful misconduct in each case that results in a Security Incident.]
DPA Liability Cap
This is a preview. The full template is free on GitLaw.
England & Wales note
This version is drafted for England & Wales. Scotland and Northern Ireland differ on some points — for example notice periods and tribunal procedure. Tell GitLaw where you hire and it adjusts the draft.
Jurisdiction
European Union
England & Wales
Scotland
Document info
HTML document. Document created on Tue Jul 15th, 2025. Last updated on Fri Oct 17th, 2025.
This document is public
Licensed under CC BY 4.0 (Attribution).
Come to agreements faster
Write, review, negotiate, and manage legal contracts
Related documents
California (US)
Github Open Source Applications Terms And Conditions (GitHub)
These terms govern the use of executable code for open source applications provided by a software company. They clarify that while source code is under separate open source licenses, the executable version is subject to these specific conditions, including trademark restrictions on logos and auto-update service limitations.
Updated 13 Aug 2026
General
Service Level Agreement (SLA) (Basecamp)
This document establishes a performance guarantee for software uptime, ensuring high availability for users of a specific service. It provides for automatic account credits if service availability falls below a defined percentage, calculated as ten times the hourly rate for downtime exceeding five minutes.
Updated 13 Aug 2026
Report a Violation on Formulaic by Mozilla
This notice explains how users can report content policy violations on a digital platform and outlines the subsequent moderation and appeals process. It specifies the information required for a report, the potential penalties for publishers, and the six-month window for appealing a moderation decision.
Updated 13 Aug 2026
FeaturedUS
Acceptable Use Policy by Mozilla
This policy defines prohibited activities for users of a company's digital services and products. It establishes clear boundaries against illegal acts, harassment, malware distribution, and intellectual property infringement while reserving the right to suspend users who violate these terms.
Updated 13 Aug 2026
US
Github Terms Github Marketplace Terms Of Service (GitHub)
This agreement governs the use of a digital marketplace for selecting and purchasing developer applications or actions. It establishes the legal relationship between the platform operator, third-party software providers, and users who install these tools.
Updated 13 Aug 2026
General
Landscaping Contract by EasyLegalDocs
This landscaping services agreement establishes the terms for garden maintenance, design, and installation work at a client's property. It covers recurring service schedules, payment terms, and technical requirements for project modifications.
Updated 13 Aug 2026
Frequently asked questions
A template isn't binding on its own - like any contract, it becomes binding once it's properly completed and signed. Templates in our curated library are professionally drafted for US or UK law; review any template before you sign it.
Yes. Chat with GitLaw to edit any section, or make changes directly in the editor.
Yes, read about team plans here.
Describe what you need in the chat and GitLaw will draft it for you.
Templates in our curated library are professionally drafted for US or UK law. The wider library comes from the GitLaw community and public sources - a solid starting point, but check any template fits your situation before you rely on it.
Mostly US and UK law. Some templates use general commercial terms that work across jurisdictions, and many note which law they're written for.
It depends on the situation. Templates work well for routine business agreements. For anything involving significant money, complex IP, employment, or areas you're unsure about, it's worth getting professional advice before you sign. GitLaw provides templates and tools, not legal advice.
Open any template in GitLaw and describe the change you want in the chat — 'make clause 4 mutual' or 'add a 30-day notice period', for example. GitLaw drafts the revised language and shows it as a suggested edit. You accept, reject, or keep editing from there.
Yes. Upload a Word, PDF, or Markdown file and GitLaw will open it in the editor. You can review, edit, or chat with GitLaw about it the same way you would with any template from the library.
Trusted by 5,000+ businesses
From template to signed, in one place
Every template opens in an editor with an AI agent alongside it.
1
Open
Pick a template and open it. Nothing to download, and no credit card to start.
Free to open
2
Edit with AI
Describe your situation in chat and the agent adapts the wording, clause by clause.
Tracked changes you can review
3
Send and sign
Share it for negotiation, then collect signatures without leaving GitLaw.
eSign included
Built for your legal work,
with practicing lawyers
Trained on 5,500+ clauses and specialist areas of law. Built with a standards committee of independent lawyers.
Adam Frankel
General Counsel · Technology & AI
15+ years as General Counsel to technology, cloud & AI companies
Juliana Calil
Principal Counsel · Technology & Entertainment
20+ years in-house at Google, Intel, Disney and Looker
Adam Wardel
General Counsel, Data Privacy Officer & AI Advisor
12+ years leading legal & privacy for SaaS and AI companies
John Hoffman
Associate Director, Corporate Counsel · Life Sciences & Technology
20+ years in corporate counsel, incl. senior counsel at Certara
Richard Nohe
General Counsel · Telecom, Cloud & Data Centers
20+ years in-house, regional General Counsel at BT across 30+ countries
Joe Al-Khayat
General Counsel · Technology & High-Growth Companies
Cross-jurisdictional M&A and SaaS contracting across the UK, US & Australia
Joshua Woo
Technology, AI & Privacy Counsel · APAC
Former Goldman Sachs Executive Director for AI, cybersecurity & privacy in APAC
Sahil Verma
International Business & Investment Lawyer
13+ years in business law, investment law & dispute resolution
Matthew Willis
CRO & General Counsel · SaaS
Former President of the ACC's 2,200-attorney Chicago Chapter · JD + Kellogg MBA
Mayowa Ogunrinola
Legal Consultant · Fintech & AI Compliance
Regulatory strategy, AI governance & data protection for fintech and AI
Steven J. Shanker
Partner and Chair of Corporate and Employment Law
25+ years as a corporate & employment attorney in New York
Rebecca Babbage
Legal Counsel · Financial Services, Corporate & Governance
UK-qualified solicitor working in-house with regulated entities in financial services
Ready to get started?
No sales calls, no credit card. Just chat with GitLaw.
GitLaw provides templates and tools, not legal advice. Templates are a starting point, not a substitute for advice on your situation - for anything significant, speak to a qualified lawyer.