Data Processing Agreement Generator

Close

Step 1 of 6

Website or app

Where do customers use your service?

Why we ask
Select every platform your customers use. The DPA names each one as part of the service it covers.

Select all that apply.

Why we ask
Enter the URL of the website your customers use. The URL appears in the DPA so customers know which service it covers.

Why we ask
Use the public name your customers recognize: your brand, product, or service name. It appears in the DPA and names it in your dashboard.

Why we ask
Enter the name of the app as customers see it in the Apple App Store or Google Play Store. It appears in the DPA.

We'll email you a link to choose a password for your account.

By creating an account, you agree to our Terms of Use and confirm you have read our Privacy Policy.

Over 1.9 million customers have created a legal agreement with TermsFeed.

Are you a business or running this yourself?

Why we ask
Pick business if a registered legal entity (an LLC, a corporation or a partnership) owns the website or app. Pick individual if you run it under your own name. A business adds its legal name and address, which appear in the policy.

Where are you based?

Why we ask
Your country does not change the text of this policy. It sets only the spelling of the English text: British or American.

Where are your customers based?

Why we ask
The laws that apply depend on where your customers are. The GDPR applies to customers in the EU and EEA, the UK GDPR to the UK, the FADP to Switzerland, and the CCPA and other state laws to the United States. The DPA names each law that applies and adds the terms it asks for.

Select all that apply.

What do you do with your customers' personal data?

Why we ask
Article 28 of the GDPR asks a DPA to describe the nature and purpose of the processing. The DPA lists each purpose in Annex I.

Select all that apply.

Whose personal data do you process for your customers?

Why we ask
A DPA names the groups of people whose data is processed, such as the users or employees of your customers. The DPA lists each group in Annex I.

Select all that apply.

What kinds of personal data do you process?

Why we ask
A DPA names the kinds of personal data processed. The DPA lists each one in Annex I.

Select all that apply.

Do you process sensitive personal data, such as health or biometric data?

Why we ask
The GDPR calls these special categories of personal data and allows them only under extra conditions. The DPA lists the ones you process in Annex I and asks your customers to make sure they may share them.

Which kinds?

Select all that apply.

Do other companies process your customers' data for you?

Why we ask
Hosting providers, email services and support tools that handle your customers' data are subprocessors. The GDPR asks you to have your customers' authorization to use them, and the DPA gives it with a list your customers can check.

Where do you list them?

Add each company with what it does and where it processes the data.

How much notice do you give before adding a subprocessor?

Why we ask
The DPA gives your customers this many days to object to a new subprocessor before it starts processing their data.

Pick one.

Why we ask
The DPA states where the data is stored, so your customers can tell whether it leaves their country. Name the country or region, such as the European Union or the United States.

Does personal data leave the EEA, the UK or Switzerland?

Why we ask
Data leaves these regions when you or a subprocessor store or access it from another country, such as the United States. The GDPR allows this only with safeguards, and the DPA adds the ones you use.

Which safeguards do you use?

Select all that apply.

How do you protect your customers' data?

Why we ask
Article 28 of the GDPR asks a DPA to describe the security measures that protect the data. The DPA lists each one in Annex II, so select only the measures you have in place.

Select all that apply.

How quickly will you tell customers about a data breach?

Why we ask
Your customers decide how their data is used, so a breach is theirs to report. The GDPR gives them 72 hours from learning of a breach to tell their data protection authority, and your notice starts that clock. The DPA promises a notice without undue delay and within the time you choose.

Pick one.

How soon do you delete a customer's data after they leave?

Why we ask
When a customer stops using your service, the GDPR asks you to delete or return their data. The DPA promises to do it within the period you choose.

Pick one.

Will your customers sign this DPA?

Why we ask
Some customers ask for a signed copy. Choose Yes to add signature lines at the end of the DPA. Without them, the DPA applies as part of your terms of service.

How can customers reach you about data protection?

Why we ask
Select every way customers can reach you about their personal data, such as a request from one of their users or a question about a breach notice. The DPA lists each one.

Select all that apply.

Check your inbox

We've sent an email to

Open the link in the email to choose a password and continue to your account.