Data Processing Addendum DPA Template for the United States

A Data Processing Addendum (DPA) is a legal agreement that defines how personal data will be processed when you engage a third-party service provider. Under United States law, this document creates binding obligations for data protection and helps ensure compliance with federal and state privacy regulations including CCPA, HIPAA, and GLBA.

When do you need this document?

You need a DPA whenever you share personal data with vendors, contractors, or service providers who will process that data on your behalf. This includes cloud storage providers, software-as-a-service platforms, marketing agencies handling customer data, payroll processors managing employee information, and healthcare third parties accessing patient records. The agreement is particularly critical when dealing with sensitive data categories such as financial information, health records, or personal identifiers that trigger specific regulatory requirements.

Key legal considerations

Your DPA must clearly define the scope and purpose of data processing, specifying exactly what data will be processed and for which business purposes. The processor's security obligations should include technical and organizational measures to protect personal data, incident response procedures, and requirements for data breach notification. You should include provisions for data subject rights fulfillment, such as access, deletion, and correction requests. Sub-processor agreements are essential when your primary processor engages additional third parties. The document should address data retention periods, deletion requirements upon contract termination, and audit rights to ensure ongoing compliance.

Legal requirements in United States

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), your DPA must address consumer rights including data deletion, access, and opt-out requirements. Healthcare organizations must ensure HIPAA compliance through business associate agreements that may be incorporated into or supplement the DPA. Financial institutions must meet Gramm-Leach-Bliley Act requirements for safeguarding customer information. Emerging state laws in Virginia, Colorado, Utah, and Connecticut impose additional obligations for data processing agreements. Federal Trade Commission guidelines require reasonable data security measures and prohibit unfair or deceptive practices. If you process data from international sources, GDPR adequacy considerations may apply, requiring additional contractual safeguards for cross-border data transfers.