Data Processing Agreement (POPIA)

Template Overview

  • Template ID: dpa
  • Version: 1.0.0

To generate this document, pass the structured data described below into the data property of the /api/v1/documents/generate endpoint.

Data Payload Schema

FieldTypeRequirementDescription & Details
companyNamestringYesLegal name of your organisation You are the operator. Ex: Acme Technologies (Pty) Ltd
companyTypestringYesType of entity Options: "Private Company ((Pty) Ltd)", "Public Company (Ltd)", "Personal Liability Company (Inc.)", "Close Corporation (CC)", "Non-Profit Company (NPC)", "Partnership", "Sole proprietor / Business name", "Trust"
registrationNumberstringNoCompany / entity registration number CIPC registration number. Ex: 2019/123456/07
addressstringYesRegistered address
productNamestringYesProduct or service name The service under which you process personal information. Ex: Vega
contactEmailstringYesContact email for data protection matters
effectiveDatestringNoEffective date of this agreement (Format: YYYY-MM-DD.)
isAddendumbooleanNoIs this an addendum to an existing main agreement? If yes, the DPA references and forms part of a parent services agreement. If no, it is a standalone agreement with its own signature block.
mainAgreementNamestringConditionalName of the main agreement Ex: Master Subscription Agreement, Terms of Service Required if isAddendum is true.
mainAgreementDatestringConditionalDate of the main agreement (Format: YYYY-MM-DD.) Required if isAddendum is true.
processingPurposestringYesPurpose of the processing Why you process personal information for the customer. Ex: To provide contract drafting, review and management features within the Service.
dataSubjectCategoriesarray of stringsYesCategories of data subjects Whose personal information you process on the customer's behalf. Options: "The customer's customers / clients", "The customer's employees", "The customer's suppliers / contractors", "The customer's end users", "The customer's prospective customers", "Authorised users of the customer's account"
personalInformationCategoriesarray of stringsYesCategories of personal information Options: "Identifying information (name, ID number)", "Contact details", "Account and profile information", "Uploaded documents and content", "Financial and payment information", "Usage, device and log data", "Communications", "Special personal information (s26 POPIA)"
processesSpecialPersonalInfobooleanNoDoes the processing include special personal information (s26)? Triggers an additional safeguards clause for special personal information.
durationOfProcessingstringNoDuration of processing How long you process the information. Ex: For the duration of the customer's subscription, plus the retention period stated below.
usesSubOperatorsbooleanNoDo you use sub-operators (third parties that process on your behalf)?
subOperatorsarray of objectsConditionalList your sub-operators Third parties you engage to process personal information. Each entry: name (string), purpose (string), location (string). Required if usesSubOperators is true.
subOperatorConsentstringConditionalSub-operator authorisation approach How the customer authorises sub-operators. Options: "General written authorisation (notify customer of changes)", "Specific prior written authorisation for each sub-operator" Required if usesSubOperators is true.
transfersCrossBorderbooleanNoIs personal information transferred outside South Africa? Triggers a section 72 cross-border transfer clause.
crossBorderSafeguardsarray of stringsConditionalSection 72 ground(s) for cross-border transfers Options: "Recipient subject to a law / binding rules / agreement providing adequate protection (s72(1)(a))", "The data subject has consented (s72(1)(b))", "Necessary for performance of a contract with the data subject (s72(1)(c))", "For the data subject's benefit and consent not reasonably practicable (s72(1)(d)/(e))" Required if transfersCrossBorder is true.
breachNotificationHoursnumberNoBreach notification window (hours) How quickly you notify the customer of a security compromise. POPIA requires notification 'as soon as reasonably possible'; a defined window is best practice. Ex: 48
allowsAuditsbooleanNoDo you grant the customer audit rights? Whether the customer may audit or inspect your compliance.
auditApproachstringConditionalAudit approach Options: "Customer may request audits on reasonable notice", "Third-party audit reports / certifications provided on request", "Both" Required if allowsAudits is true.
returnOrDeletestringYesOn termination, personal information is Options: "Returned to the customer, then deleted", "Deleted, unless the customer requests return", "Returned or deleted at the customer's election"
deletionDaysnumberNoDays to return or delete after termination Ex: 30
providesDeletionCertificatebooleanNoDo you provide a deletion certificate on request?
includesIndemnitybooleanNoInclude an indemnity for breach of this agreement? Whether the operator indemnifies the customer against losses arising from the operator's non-compliance.
liabilityCapstringNoLiability cap approach Options: "Cap aligned to the main agreement's liability cap", "A specified amount", "No separate cap (governed by main agreement)"
liabilityCapAmountstringConditionalSpecified liability cap amount Ex: ZAR 1,000,000 or fees paid in the preceding 12 months Required if liabilityCap is "Specified amount".
prefillCustomerbooleanNoPre-fill a specific customer's details? If no, the agreement leaves blank fields for the customer to complete on signing.
customerNamestringConditionalCustomer (responsible party) legal name Required if prefillCustomer is true.
customerRegistrationNumberstringConditionalCustomer registration number Required if prefillCustomer is true.
customerAddressstringConditionalCustomer registered address Required if prefillCustomer is true.
customerContactEmailstringConditionalCustomer contact email Required if prefillCustomer is true.
governingLawstringNoGoverning law

Example JSON Payload

Here is an example of a properly formatted data object for the Data Processing Agreement (POPIA) template.

{
  "templateId": "dpa",
  "data": {
    "companyName": "Acme Technologies (Pty) Ltd",
    "companyType": "Private Company ((Pty) Ltd)",
    "registrationNumber": "2019/123456/07",
    "address": "123 Beta Way, Lagos",
    "productName": "Vega",
    "contactEmail": "legal@acmecorp.com",
    "effectiveDate": "2026-06-01",
    "isAddendum": false,
    "processingPurpose": "To provide contract drafting, review and management features within the Service",
    "dataSubjectCategories": [
      "The customer's customers / clients",
      "The customer's employees"
    ],
    "personalInformationCategories": [
      "Identifying information (name, ID number)",
      "Contact details"
    ],
    "processesSpecialPersonalInfo": false,
    "durationOfProcessing": "For the duration of the customer's subscription, plus the retention period stated below",
    "usesSubOperators": true,
    "subOperators": [
      {
        "name": "Sample Name",
        "purpose": "Sample Purpose",
        "location": "Sample Location"
      }
    ],
    "subOperatorConsent": "General written authorisation (notify customer of changes)",
    "transfersCrossBorder": true,
    "crossBorderSafeguards": [
      "Recipient subject to a law / binding rules / agreement providing adequate protection (s72(1)(a))",
      "The data subject has consented (s72(1)(b))"
    ],
    "breachNotificationHours": 48,
    "allowsAudits": true,
    "auditApproach": "Customer may request audits on reasonable notice",
    "returnOrDelete": "Returned to the customer, then deleted",
    "deletionDays": 30,
    "providesDeletionCertificate": true,
    "includesIndemnity": true,
    "liabilityCap": "Cap aligned to the main agreement's liability cap",
    "prefillCustomer": false,
    "governingLaw": "Sample Governing Law"
  },
  "format": "pdf"
}