DPA Agreement Template for South Africa

A Data Processing Agreement (DPA) is a fundamental legal document required under South Africa's Protection of Personal Information Act (POPIA) that establishes the contractual relationship between organizations when personal information is processed by third parties. Under POPIA, you must have a written DPA in place before any data processor begins handling personal information on your behalf, making this document essential for legal compliance and data protection.

When do you need this document?

You need a DPA Agreement whenever your organization engages a third-party service provider to process personal information on your behalf. This includes cloud storage providers, payroll companies, marketing agencies handling customer data, IT support services accessing employee information, or any outsourced function involving personal data. The agreement is also required when appointing sub-processors, establishing data sharing arrangements with business partners, or engaging international service providers that may transfer data outside South Africa. POPIA mandates that the DPA must be signed before any processing activities commence, making it a prerequisite for lawful data processing relationships.

Key legal considerations

Your DPA must clearly define the scope and purpose of data processing, specifying exactly what personal information will be processed and for what purposes. The agreement must establish comprehensive security measures that both parties will implement, including technical and organizational safeguards to protect personal data. You need to include provisions for data breach notification procedures, ensuring the data processor will notify you immediately of any security incidents. The contract must address data subject rights, establishing procedures for handling access requests, corrections, and deletions. Additionally, you must include clauses covering the return or destruction of personal information upon termination of the agreement, and restrictions on the processor's ability to engage sub-processors without your prior written consent.

Legal requirements in South Africa

Under POPIA, your DPA must comply with specific statutory requirements outlined in Section 21 of the Act. The agreement must ensure that personal information is processed only on your documented instructions as the data controller, and the processor must implement appropriate technical and organizational measures to secure the data. You must include provisions requiring the processor to assist with data protection impact assessments when necessary and to cooperate with the Information Regulator during investigations. The contract must address cross-border data transfers if applicable, ensuring adequate protection levels in recipient countries or implementing appropriate safeguards. Your DPA should also designate an Information Officer as required by POPIA and establish clear procedures for handling complaints and regulatory inquiries. The agreement must be governed by South African law and include dispute resolution mechanisms within South African jurisdiction.