Data Processing Agreement (GDPR)

A free template covering the legally required minimum content under Article 28 of the General Data Protection Regulation (GDPR).

Note: This template is drafted under the EU General Data Protection Regulation (GDPR) as applied in Denmark. It is provided as an English translation for your convenience.

If a partner or supplier processes personal data on behalf of your business — or vice versa — a data processing agreement isn't just a good idea, it's a legal requirement under GDPR Article 28. Read our full walkthrough of when you need a data processing agreement rather than an ordinary data usage agreement (currently in Danish).

Important: This template covers the legally required minimum content under GDPR Article 28(3). If the processing is complex — for example involving transfers of data outside the EU/EEA — the agreement should be supplemented by a lawyer or data protection advisor.

What does the template contain?

  • Fields for the data controller and the data processor, including registration numbers
  • The subject matter, duration, nature and purpose of the processing
  • The processor's obligations under GDPR Article 28(3) — including instructions authority, confidentiality, security measures and sub-processors
  • Assistance with data subjects' rights and the controller's other GDPR obligations
  • Transfers to third countries
  • Personal data breaches and notification deadlines
  • Deletion or return of data upon termination
  • A signature table for both parties

Who needs this agreement?

Any business that has an external party process personal data on its behalf — for example an IT system, a marketing partner, or an external payroll administrator — is required to have a data processing agreement in place. This applies regardless of the business's size.

Download as PDF or Word:

Download as PDF Download as Word

The template is free and does not constitute legal advice. Data processing agreements are legally required, and we recommend having it reviewed by a lawyer or data protection advisor before it's signed. Book a no-obligation call if you'd like help.

Book a no-obligation call →
Knowledge Hub

Read more about data and GDPR

Confidentiality Agreement

Non-Disclosure Agreement (NDA) for a Business Sale: What It Should Include

An NDA is the first document that should be signed once a buyer conversation gets serious — before you share figures, customers or other sensitive details.

1
Overgangsperiode

How Long Should the Seller Stay After a Business Sale?

There's no legal requirement to stay – but most buyers expect a transition period. See what's normal, and how it's typically agreed.

2
Datarum & VDR

Data Room in a Business Sale – What Should It Contain?

A well-organised data room can speed up due diligence significantly – a messy one can raise red flags. See the full checklist.

3