# Data Processing Agreement Template, Word and PDF Source: https://nerix.ai/templates/data-processing-agreement Buy to download This page shows a preview. Buy the document on nerix.ai to download it as Word and PDF and print it. https://nerix.ai/templates/data-processing-agreement # Data processing agreement Agree how a supplier may handle personal data for you: purpose, security, sub-processors, breaches and deletion. Before you send it Data protection laws differ by country, and some, such as the GDPR in the EU and the UK, list exactly what a processing agreement must contain and require extra steps for transfers to other countries. This template does not assume one law. It refers to the data protection laws that apply, so check which ones cover the personal data you handle, and add what they require. It is a plain starting point and is not legal advice. Have a lawyer review it if the data is sensitive or the volume is large. ## Fill it in and preview You are signed in. Fill it in your workspace and it is kept as a document you can send, share and have signed. [Open in your workspace](https://app.nerix.ai/documents/templates/data-processing-agreement) **€9.99, pay once, Word and PDF** Included in every paid nerix plan. ### Data Processing Agreement This agreement is made on 1 December 2026 between: - **Brightwater Analytics Ltd**, of 20 Harbour Street, Dublin D02 AB12, Ireland , contact [privacy@brightwater.example](mailto:privacy@brightwater.example) ("the Customer"); and - **CloudMail Services GmbH**, of Hauptstrasse 14, 10115 Berlin, Germany , contact [dpo@cloudmail.example](mailto:dpo@cloudmail.example) ("the Provider"). It forms part of the Email Platform Services Agreement dated 3 March 2026 ("the Main Agreement"). If this agreement and the Main Agreement conflict on the handling of personal data, this agreement applies. ## 1. Definitions In this agreement "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning they have in the data protection laws that apply, or, where those laws use other words for the same ideas, the nearest meaning. "Data Protection Laws" means all laws on data protection and privacy that apply to the processing of Customer Personal Data under this agreement, including any that apply to a party because of where the data subjects are. "Customer Personal Data" means the personal data that the Provider processes for the Customer under the Main Agreement. "Sub-processor" means a third party that the Provider uses to process Customer Personal Data. ## 2. Roles and scope 2.1 For Customer Personal Data the Customer is the controller and the Provider is the processor. If the Customer is itself a processor for another controller, it promises that it has that controller's authority to give the instructions in this agreement, and the Provider acts as a sub-processor. 2.2 Each party will follow the Data Protection Laws that apply to it. 2.3 The Customer is responsible for having a lawful basis for the processing, for giving the notices that the Data Protection Laws require to data subjects, and for the accuracy and lawfulness of the personal data it gives the Provider. ## 3. Details of the processing 3.1 Subject matter and purpose. The Provider processes Customer Personal Data only to provide the services under the Main Agreement, in this way: Sends and stores the customer's marketing and service emails, and records opens and clicks, to provide the email platform. 3.2 Duration. The processing lasts for as long as the main agreement runs, plus the time needed to return or delete the data . 3.3 Types of personal data: Names, email addresses, company names, and records of emails sent, opened and clicked. 3.4 Categories of data subjects: the customer's clients, prospects and newsletter subscribers . 3.5 Sensitive personal data that is handled: health information that patients write in appointment messages . 3.6 Place of processing. The Provider will process and store Customer Personal Data in data centres in Frankfurt, Germany . 3.7 The Customer will not give the Provider other types of personal data, or sensitive personal data not listed above, without the Provider's written agreement. ## 4. The Customer's instructions 4.1 The Provider will process Customer Personal Data only on the Customer's documented instructions, which are this agreement, the Main Agreement, and the Customer's use and settings of the services, unless a law that applies to the Provider requires otherwise. In that case the Provider will tell the Customer before the processing, unless that law forbids it. 4.2 The Provider will tell the Customer at once if it believes that an instruction breaks the Data Protection Laws. It may pause the instruction until the Customer confirms or changes it. 4.3 The Provider will not use Customer Personal Data for its own purposes, sell it, or combine it with data from other sources, except as the Data Protection Laws allow for its own legal duties. 5. Staff and confidentiality 6. Security 7. Sub-processors ⁦2 / 7⁩ 8. Help with data subjects' rights 9. Personal data breach 10. Impact assessments and authorities ⁦3 / 7⁩ 11. Transfers outside the region 12. Audits 13. Return and deletion 3 more pages ⁦4 / 7⁩ The full document unlocks when you download The rest is written and waiting, with your answers in place. Templates are a careful starting point, not legal advice. Where the law matters, check what applies where you are. Company and legal ## What this template is for A data processing agreement between a company and a supplier that handles personal data for it: roles, security, sub-processors, breaches and deletion. It is free to fill in online and needs no account. The finished Word document and PDF cost €9.99, paid once. [See all Company and legal templates](https://nerix.ai/templates/company-legal) Company and legal ## What you fill in The form asks for 23 details. The document fills itself in as you type. - ### Customer (the controller): name For example: Brightwater Analytics Ltd - ### Customer: address For example: 20 Harbour Street, Dublin D02 AB12, Ireland - ### Customer: contact for data protection For example: privacy@brightwater.example - ### Provider (the processor): name For example: CloudMail Services GmbH - ### Provider: address For example: Hauptstrasse 14, 10115 Berlin, Germany - ### Provider: contact for data protection For example: dpo@cloudmail.example - ### The main agreement this belongs to The contract under which the provider offers its service. For example: the Email Platform Services Agreement dated 3 March 2026 - ### Effective date For example: 1 December 2026 - ### What the provider does with the data, and why The nature and purpose of the processing. For example: Sends and stores the customer's marketing and service emails, and records opens and clicks, to provide the email platform. - ### Types of personal data For example: Names, email addresses, company names, and records of emails sent, opened and clicked. - ### Sensitive personal data, if any optional Leave it empty if none is handled. For example: health information that patients write in appointment messages - ### Whose data it is For example: the customer's clients, prospects and newsletter subscribers - ### How long the processing lasts For example: for as long as the main agreement runs, plus the time needed to return or delete the data - ### Where the data is processed and stored For example: in data centres in Frankfurt, Germany - ### Hours to report a personal data breach How soon the provider must tell the customer after it learns of a breach. For example: 48 - ### Approved sub-processors (optional) optional One per line, with the place and what each does. For example: Hetzner Online GmbH, Gunzenhausen, Germany, for hosting Postmark, Philadelphia, USA, for delivery of emails - ### Days of notice before a new sub-processor For example: 30 - ### Security measures For example: Encryption of data in transit and at rest; access limited by role and protected by multi-factor sign-in; daily backups kept for 30 days; logging of access; yearly security tests. - ### Days after the end to return or delete the data For example: 30 - ### Limit of liability under this agreement Or a sum, such as EUR 500,000. For example: the limit in the main agreement - ### Country or state whose law applies For example: Ireland - ### Place for disputes For example: Dublin - ### How disputes are decided Company and legal ## What is inside The parts of this document, in order. - 1 1. Definitions - 2 2. Roles and scope - 3 3. Details of the processing - 4 4. The Customer's instructions - 5 5. Staff and confidentiality - 6 6. Security - 7 7. Sub-processors - 8 8. Help with data subjects' rights - 9 9. Personal data breach - 10 10. Impact assessments and authorities - 11 11. Transfers outside the region - 12 12. Audits Templates ## How it works - 01 ### Fill in Type your details in the form. The document fills itself in as you type; click any gap to jump to its field. - 02 ### Check Read it through. Gaps you have not filled stay marked, so nothing goes out half done. - 03 ### Download Pay once and get it as a Word document to edit further and as a PDF to send or print. The link comes by email too. ### Was this template helpful? Company and legal ## Questions people ask ### What details does this template ask for? The form asks for 23 details, starting with Customer (the controller): name, Customer: address, Customer: contact for data protection, Provider (the processor): name, Provider: address. 2 more are optional. ### How much does this template cost? €9.99, paid once. Filling it in and seeing the first part is free. You pay when you download the finished Word document and PDF, with no account and no subscription. Every paid nerix plan includes it. ### Can I download this template as Word or PDF? Yes. When you have filled in the form, press Download and pay once. You get the finished document as a Word file to keep editing and as a PDF to send or print, and the link by email. ### Is what I type sent anywhere? While you fill it in, what you type stays in your browser. When you buy the document, your answers go to nerix to make your files. They are kept for seven days so you can download again, then deleted. ### What should I check before I use this template? Data protection laws differ by country, and some, such as the GDPR in the EU and the UK, list exactly what a processing agreement must contain and require extra steps for transfers to other countries. This template does not assume one law. It refers to the data protection laws that apply, so check which ones cover the personal data you handle, and add what they require. It is a plain starting point and is not legal advice. Have a lawyer review it if the data is sensitive or the volume is large. ### Are these company templates free? Most are. Fill in and download them for free as Word or PDF, with no account. A few longer documents are premium: free to fill in, paid once to download, and marked with their price. ### Is a template the same as legal advice? No. A template is a careful starting point. Company, contract and data protection law differ by country, so have a lawyer read anything that carries real risk before you sign. ### Can I change the clauses? Yes. Download the Word version and edit it, or open the template in the nerix chat and ask for a clause that is stricter, shorter or in another language. Templates ## More in Company and legal - [Acceptable use policy Set clear rules for using your systems, accounts, devices and services, and what happens when they are broken. Company and legal](https://nerix.ai/templates/acceptable-use-policy) - [Agency agreement Appoint an agent to find customers and negotiate sales for you in an area, for a commission. Company and legal Premium, €9.99](https://nerix.ai/templates/agency-agreement) - [Anti-bribery policy State that you never give or take bribes, set gift and hospitality limits, and say how to report concerns. Company and legal Premium, €4.99](https://nerix.ai/templates/anti-bribery-policy) - [Board committee terms of reference Define what a board committee is for: members, powers, meetings, reporting and how it is reviewed. Company and legal](https://nerix.ai/templates/board-committee-terms-of-reference) - [Board evaluation form Rate how well the board works as a group, note strengths and gaps, and agree actions for the year ahead. Company and legal](https://nerix.ai/templates/board-evaluation-form) - [Board meeting minutes Record a board meeting: who was there, what was decided and the vote on each resolution. Company and legal](https://nerix.ai/templates/board-minutes) [See all Company and legal templates](https://nerix.ai/templates/company-legal) Templates ## More kinds of documents Every category has its own page, so you can see all of its templates at once. ## Use it in nerix ### Use it in nerix - [Templates](https://nerix.ai/product/templates) - [E-signatures](https://nerix.ai/product/e-signatures) ### Learn more - [How to Make a Document From a Template](https://nerix.ai/help/make-a-document-from-a-template) - [Company and legal](https://nerix.ai/templates/company-legal) ## Keep reading - Quality and audits GDPR [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [GDPR checklist for small businesses](https://nerix.ai/blog/gdpr-checklist-for-small-businesses) A GDPR checklist for small businesses, article by article. Lawful basis, privacy notice, processors, security, 72 hour breach reports and data subject requests. Read the guide