Data Processing Agreement

Template Overview

Template ID: dpa-general
Version: 2.0.0

To generate this document, pass the structured data described below into the data property of the /api/v1/documents/generate endpoint.

Data Payload Schema

Field	Type	Requirement	Description & Details
`jurisdiction`	`string`	Yes	Governing data protection law Determines terminology, the regulator, the transfer regime and statutory references throughout. Options: `"South Africa (POPIA)"`, `"United Kingdom (UK GDPR + Data Protection Act 2018)"`, `"Nigeria (NDPA 2023)"`
`companyName`	`string`	Yes	Legal name of your organisation You are the Service Provider / Data Processor.
`companyType`	`string`	Yes	Type of entity Options: `"Private Company"`, `"Public Company"`, `"Limited Liability Partnership"`, `"Partnership"`, `"Sole proprietor / Business name"`, `"Other"`
`registrationNumber`	`string`	No	Company / entity registration number
`countryOfIncorporation`	`string`	Yes	Country of incorporation
`address`	`string`	Yes	Registered address
`productName`	`string`	Yes	Product or service name The service under which you process personal data.
`breachNotificationEmail`	`string`	Yes	Email for breach notifications and data protection matters
`effectiveDate`	`string`	No	Date of this agreement (Format: `YYYY-MM-DD`.)
`mainContractName`	`string`	No	Name of the main contract The principal services agreement this DPA supports. Ex: Master Subscription Agreement or Terms of Service.
`mainContractDate`	`string`	No	Date of the main contract (Format: `YYYY-MM-DD`.)
`survivesMainContract`	`boolean`	No	Does this DPA survive beyond the term of the main contract? If yes, the DPA remains in force for as long as you continue to process personal data for the customer.
`processingPurpose`	`string`	Yes	Purpose of the processing (Admissible Purpose) Describe the purpose of the processing in plain language. Ex: To provide the Service Provider's software platform to the customer, and to provide related support and services.
`dataSubjectCategories`	`array of strings`	Yes	Categories of data subjects Options: `"The customer's customers / clients"`, `"The customer's employees"`, `"The customer's suppliers / contractors"`, `"The customer's end users"`, `"The customer's prospective customers"`, `"Authorised users of the customer's account"`
`personalDataCategories`	`array of strings`	Yes	Categories of personal data (Company Personal Data) Options: `"Identifying information (name, ID number)"`, `"Contact details (address, email, telephone)"`, `"Account and profile information"`, `"Uploaded documents and content"`, `"Financial and payment information"`, `"Employment and HR information"`, `"Usage, device and log data"`, `"Special category / sensitive personal data"`
`processesSpecialData`	`boolean`	No	Does the processing include special category / sensitive personal data?
`durationOfProcessing`	`string`	No	Duration of processing
`usesSubProcessors`	`boolean`	No	Do you engage sub-processors?
`subProcessors`	`array of objects`	Conditional	Approved (Identified) sub-processors Each entry: `name` (string), `address` (string), `purpose` (string), `location` (string). Required if `usesSubProcessors` is `true`.
`subProcessorObjectionWeeks`	`number`	Conditional	Objection window for new sub-processors (weeks) How long the customer has to object to a proposed new sub-processor. Ex: 4 Required if `usesSubProcessors` is `true`.
`transfersCrossBorder`	`boolean`	No	Is personal data processed or transferred outside the country of origin?
`transferMechanism`	`array of strings`	Conditional	Transfer mechanism(s) relied on Options: `"Transfer to an adequate jurisdiction (adequacy)"`, `"Standard Contractual Clauses (SCCs)"`, `"UK International Data Transfer Agreement (IDTA) / Addendum"`, `"Binding Corporate Rules (BCRs)"`, `"NDPC-approved Cross-Border Data Transfer Instrument (CBDTI)"`, `"Data subject's explicit consent"`, `"Necessary for performance of a contract with the data subject"` Required if `transfersCrossBorder` is `true`.
`breachNotificationHours`	`number`	No	Breach notification window to the customer (hours) Maximum hours after becoming aware of a Data Security Incident. The reference uses 24.
`hasDPO`	`boolean`	No	Have you appointed a Data Protection Officer (DPO)?
`dataSecurityStandard`	`string`	No	Data security standard / certification (Schedule 3) Ex: ISO/IEC 27001, plus your internal data security policy. Leave blank to mark Schedule 3 'to be inserted'.
`deletionOnTermination`	`boolean`	No	Delete (or return) personal data on termination?
`includesIndemnity`	`boolean`	No	Include a processor indemnity in favour of the customer?
`liabilityCap`	`string`	No	Liability cap approach Options: `"Cap aligned to the main contract"`, `"A specified amount"`
`liabilityCapAmount`	`string`	Conditional	Specified liability cap amount Required if `liabilityCap` is `"Specified amount"`.
`prefillCustomer`	`boolean`	No	Pre-fill a specific customer's details?
`customerName`	`string`	Conditional	Customer legal name Required if `prefillCustomer` is `true`.
`customerRegistrationNumber`	`string`	Conditional	Customer registration number Required if `prefillCustomer` is `true`.
`customerAddress`	`string`	Conditional	Customer registered address Required if `prefillCustomer` is `true`.
`governingLaw`	`string`	No	Governing law and jurisdiction Defaults to the selected data protection jurisdiction.

Example JSON Payload

Here is an example of a properly formatted data object for the Data Processing Agreement template.

{
  "templateId": "dpa-general",
  "data": {
    "jurisdiction": "South Africa (POPIA)",
    "companyName": "Acme Corp",
    "companyType": "Private Company",
    "registrationNumber": "Sample Registration Number",
    "countryOfIncorporation": "Sample Country Of Incorporation",
    "address": "123 Beta Way, Lagos",
    "productName": "Sample Product Name",
    "breachNotificationEmail": "legal@acmecorp.com",
    "effectiveDate": "2026-06-01",
    "mainContractName": "Master Subscription Agreement or Terms of Service",
    "mainContractDate": "2026-06-01",
    "survivesMainContract": true,
    "processingPurpose": "To provide the Service Provider's software platform to the customer, and to provide related support and services",
    "dataSubjectCategories": [
      "The customer's customers / clients",
      "The customer's employees"
    ],
    "personalDataCategories": [
      "Identifying information (name, ID number)",
      "Contact details (address, email, telephone)"
    ],
    "processesSpecialData": false,
    "durationOfProcessing": "Sample Duration Of Processing",
    "usesSubProcessors": true,
    "subProcessors": [
      {
        "name": "Sample Name",
        "address": "123 Beta Way, Lagos",
        "purpose": "Sample Purpose",
        "location": "Sample Location"
      }
    ],
    "subProcessorObjectionWeeks": 4,
    "transfersCrossBorder": false,
    "breachNotificationHours": 1,
    "hasDPO": false,
    "dataSecurityStandard": "ISO/IEC 27001, plus your internal data security policy",
    "deletionOnTermination": true,
    "includesIndemnity": true,
    "liabilityCap": "Cap aligned to the main contract",
    "prefillCustomer": false,
    "governingLaw": "Sample Governing Law"
  },
  "format": "pdf"
}