DATA PROCESSING AGREEMENT (SAAS)

PREAMBLE

This Data Processing Agreement (DPA) dated [Date] between [Company/Controller] ("Controller") and [SaaS Provider] ("Processor") establishes data processing terms pursuant to GDPR Article 28, German BDSG (Data Protection Act), US GLBA 15 USC §6801 (if applicable). **This DPA is MANDATORY and overrides conflicting SaaS Terms.**

1.1 Data Definition: Per GDPR Art. 4:
• "Personal Data": Any information relating to identified/identifiable natural person (name, email, IP, cookies, behavioral data)
• "Processing": Collection, storage, use, analysis, deletion of personal data
• "Data Subject": Individual whose data is processed (end user, customer, employee)
1.2 Role Definitions:
• "Controller": [Company] (determines processing purposes/means) per Art. 4(7)
• "Processor": [SaaS Provider] (processes data on Controller's behalf per Art. 4(8))
• "Sub-Processor": Third-party contractor engaged by Processor per Art. 28(2)
1.3 Subject Data: Processor processes only: [customer data, user data, transaction data, other: ________]
• Volume: [approx. X GB/TB per month]
• Types: [names, emails, payment info, usage logs, other]

2.1 Limited Processing: Processor shall process data ONLY per Art. 28(3):
☑ Controller's written instructions (in writing, documented)
☑ Purpose: [provide SaaS service / customer analytics / billing / other]
☑ NO processing for Processor's own purposes (prohibited per Art. 28(3))
☑ NO selling/licensing data to third parties
☑ NO processing for marketing/advertising (unless instructed)
2.2 Confidentiality (NON-NEGOTIABLE): Processor ensures per Art. 28(3)(b):
✓ Staff under binding confidentiality (written agreements required)
✓ No unauthorized access to personal data
✓ Data retention: Only as long as service operates (then immediate deletion)
2.3 Security & Technical Measures: Processor implements per Art. 32 (Technical Measures):
• Encryption: Data encrypted in transit (TLS 1.2+) & at rest per [AES-256 / equivalent]
• Access controls: MFA, role-based access (RBAC), audit logs
• Monitoring: Intrusion detection, vulnerability scanning (quarterly minimum)
• Backup: Daily backups (tested for recovery monthly)
• Redundancy: [X geographically-diverse data centers]
• Physical security: Restricted access, surveillance, guards
2.4 Audit & Compliance: Processor provides per Art. 28(3)(h):
• SOC 2 Type II certification (annual, shared with Controller)
• GDPR compliance attestation (yearly audit by independent auditor)
• Right to audit: Controller may audit Processor's facilities (annually, minimum)
• Documentation: Processing records (Article 5(2) accountability)

3.1 Sub-Processor Authorization: Processor may engage sub-processors ONLY with per Art. 28(2) & (4):
☑ Prior written authorization from Controller
☑ Processor publishes list of current sub-processors: [https://company.com/subprocessors]
☑ Minimum 30 days notice before adding sub-processor
☑ Controller has right to object (within 15 days) per Art. 28(4)
3.2 Sub-Processor Agreement (MANDATORY): Processor ensures sub-processor bound by:
• Same data protection obligations (equivalent to this DPA) per Art. 28(4)
• Same confidentiality, security, audit requirements
• Sub-processor liable for breaches (Processor remains liable to Controller)
3.3 Current Sub-Processors (Example):
☑ [AWS / Google Cloud / Azure] (infrastructure hosting)
☑ [Stripe / PayPal] (payment processing)
☑ [SendGrid] (email delivery)
3.4 International Data Transfer (CRITICAL): If sub-processor in non-EU country per Art. 44-50 (International Transfer):
• ☐ US (Standard Contractual Clauses per Commission Decision 2021/914)
• ☐ UK (UK Standard Contractual Clauses)
• ☐ Other: [Adequacy Decision / Binding Corporate Rules]

4.1 Data Subject Rights (NON-WAIVABLE): Processor supports Controller in responding to per Art. 12-23:
☑ Right of access: Processor provides all data Controller holds (within 5 days)
☑ Right to rectification: Processor corrects inaccurate data (within 5 days)
☑ Right to erasure ("right to be forgotten"): Processor deletes data within 10 days per Art. 17
☑ Right to data portability: Processor provides data in machine-readable format (within 10 days) per Art. 20
☑ Right to object: Processor stops processing per Controller's instruction (Art. 21)
4.2 Processor's Role in Subject Requests:
• Processor does NOT respond directly to data subjects (Controller does)
• Processor assists Controller by providing requested data immediately
• Processor acknowledges requests within 48 hours
• Processor completes requested action within [5 / 10 days]
4.3 Deletion Upon Termination: Upon DPA termination, Processor:
• Deletes ALL personal data (no copies retained) per Art. 17(1)
• OR returns all data to Controller (for Controller to manage)
• Certified deletion (written attestation provided within 30 days)

5.1 Breach Definition: Per Art. 4(12) & 33, unauthorized access/disclosure including:
• Unauthorized access to data server
• Ransomware attack (data encrypted/corrupted)
• Insider theft (employee data theft)
• Third-party hacking (SQL injection, phishing)
5.2 Notification Timeline (MANDATORY): Processor notifies Controller within per Art. 33(3):
• [24 / 48 hours] of becoming aware of breach (documented discovery time)
• Notification method: Email to [security contact]
• Information included: (a) type of breach, (b) approx. data subjects affected, (c) likely consequences, (d) remediation steps
5.3 Processor Liability for Breaches:
• Processor liable for all GDPR fines/penalties (up to EUR 20M or 4% revenue per Art. 83)
• Processor indemnifies Controller for costs of notification, credit monitoring, regulatory fines
• Exception: Breach caused solely by Controller's instructions (documented)

6.1 Data Storage Location: Data stored in:
☐ EU only (Germany: [X data center(s)])
☐ EU + international backup (specify: [X countries])
☐ US (with Standard Contractual Clauses per Schrems II ruling)
6.2 Compliance Certifications: Processor maintains:
☑ ISO 27001 (Information Security Management)
☑ SOC 2 Type II (Security, Availability, Processing Integrity)
☑ GDPR compliance audit (annual by qualified auditor)
☑ HIPAA (if health data handled)
6.3 Certification Verification: Processor provides current certifications upon request (within 5 days)

7.1 Term: DPA effective on SaaS agreement date and continues per SaaS agreement termination per Art. 28(3)(g)
7.2 Upon Termination: Processor within [30 days]:
• Deletes all personal data (per Section 5.3)
• Deletes all backups (certified deletion)
• OR returns all data to Controller in portable format
7.3 Return of Data (Alternative): If Controller requests return instead of deletion:
• Processor provides all data within 15 days (encrypted, portable format)
• Storage only for [90 days] post-termination (then automatic deletion)
• Controller responsible for retrieval costs (if>USD [X])

Law: German (GDPR + BDSG) if EU data; [US State] if US data | Disputes: GDPR Data Authority intervention → Court
Audit Rights: Controller (or independent auditor) may audit Processor's processing per Art. 28(3)(h):
• Annual audit minimum (can request more frequently for cause)
• On-site inspection allowed (48 hours notice)
• Processor provides full cooperation (no access restrictions)