Data Processing Agreement

Recommended legal data_processing_agreement

Agent Prompt Snippet

Formalize controller and processor obligations including sub-processor management, audit rights, and breach notification duties in a data processing agreement.

Purpose

A data processing agreement formalizes the obligations between data controller and processor, including sub-processor management, audit rights, and breach notification duties.

This is a Recommended document — most projects benefit significantly from having one. While not strictly essential for every situation, its absence often leads to gaps in team understanding or quality.

Key Sections to Include

Sub-processor management
Audit rights
Breach notification duties in a data processing agreement

Agent hint: Formalize controller and processor obligations including sub-processor management, audit rights, and breach notification duties in a data processing agreement.

What Makes It Good vs Bad

A strong version of this document:

Uses clear, specific language — avoids ambiguity in obligations and rights
Covers all relevant jurisdictions and regulatory frameworks
Includes practical compliance checklists, not just policy statements
Reviewed by legal counsel and updated when regulations change
Accessible to non-lawyers — includes plain-language summaries

Warning signs of a weak version:

Copy-pasted from another project without adapting to this context
Missing jurisdiction-specific requirements (GDPR, CCPA, HIPAA)
No process for tracking regulatory changes that affect the project
Overly broad or vague terms that provide no real guidance
Written once at project start and never revisited

Common Mistakes

Using template legal documents without adapting them to the project’s specifics
Not tracking changes in relevant regulations after initial compliance review
Assuming open-source licenses are interchangeable without compatibility analysis
Separating legal compliance from the engineering workflow

How to Use This Document

Engage legal counsel early — retrofitting compliance is far more expensive than designing for it. Create a compliance matrix mapping each requirement to specific technical controls. Use plain-language summaries alongside formal legal text so engineers can act on requirements without a law degree.

For AI agents: Reference legal documents when making decisions that affect user data, licensing, or regulatory compliance. Flag any changes that might introduce new legal obligations or compliance risks.

Starter Template

SpecBase includes a ready-to-use template for this document: kb/templates/legal/data_processing_agreement.md.tmpl. Use the SpecBase CLI or MCP integration to generate it pre-filled for your project.

# Generate stubs via CLI
specbase init <archetype> --features <features> --dir ./docs