Data Processing Agreement (Published)

Template Overview

Template ID: dpa-website
Version: 1.0.0

To generate this document, pass the structured data described below into the data property of the /api/v1/documents/generate endpoint.

Data Payload Schema

Field	Type	Requirement	Description & Details
`jurisdiction`	`string`	Yes	Governing data protection law Determines the terminology, regulator, transfer regime and statutory references used throughout the published DPA. Options: `"South Africa (POPIA)"`, `"United Kingdom (UK GDPR + Data Protection Act 2018)"`, `"Nigeria (NDPA 2023)"`
`companyName`	`string`	Yes	Legal name of your organisation You are the processor publishing this DPA.
`productName`	`string`	Yes	Product or service name The service this DPA covers. Ex: Vega
`agreementName`	`string`	No	Name of your main agreement What the DPA forms part of. Ex: Terms of Service, Master Subscription Agreement
`effectiveDate`	`string`	No	Last updated / effective date (Format: `YYYY-MM-DD`.)
`processingPurpose`	`string`	Yes	Purpose / nature of the processing
`durationOfProcessing`	`string`	No	Duration of processing
`dataSubjectCategories`	`array of strings`	Yes	Categories of data subjects Options: `"The subscriber's authorised users"`, `"The subscriber's clients and counterparties"`, `"The subscriber's employees"`, `"The subscriber's customers"`, `"Individuals named in uploaded documents"`
`personalDataCategories`	`array of strings`	Yes	Categories of personal data Options: `"Identifying information (name, role)"`, `"Contact details"`, `"Account and profile information"`, `"Uploaded documents and their contents"`, `"Financial and payment information"`, `"Usage, device and log data"`, `"Special category / sensitive personal data"`
`processesSpecialData`	`boolean`	No	Does the processing include special category / sensitive personal data?
`subProcessors`	`array of objects`	Yes	Sub-processors Third parties you engage to process subscriber personal data. Each entry: `name` (string), `purpose` (string), `location` (string). (Minimum 1 entry.)
`subProcessorObjectionDays`	`number`	No	Sub-processor objection window (days) How long subscribers have to object to a new sub-processor you post. Ex: 30
`transfersCrossBorder`	`boolean`	No	Is personal data processed or transferred outside the country of origin?
`dataSecurityStandard`	`string`	No	Data security standard / certification Ex: ISO/IEC 27001. Leave blank to use a general description.
`breachNotificationHours`	`number`	No	Breach notification window to subscribers (hours) Ex: 24
`deletionDays`	`number`	No	Days to return or delete data after termination
`auditFrequencyMonths`	`number`	No	Audit frequency (months) How often a subscriber may audit. Ex: 12
`includesIndemnity`	`boolean`	No	Include a processor indemnity?

Example JSON Payload

Here is an example of a properly formatted data object for the Data Processing Agreement (Published) template.

{
  "templateId": "dpa-website",
  "data": {
    "jurisdiction": "South Africa (POPIA)",
    "companyName": "Acme Corp",
    "productName": "Vega",
    "agreementName": "Terms of Service, Master Subscription Agreement",
    "effectiveDate": "2026-06-01",
    "processingPurpose": "Sample Processing Purpose",
    "durationOfProcessing": "Sample Duration Of Processing",
    "dataSubjectCategories": [
      "The subscriber's authorised users",
      "The subscriber's clients and counterparties"
    ],
    "personalDataCategories": [
      "Identifying information (name, role)",
      "Contact details"
    ],
    "processesSpecialData": false,
    "subProcessors": [
      {
        "name": "Sample Name",
        "purpose": "Sample Purpose",
        "location": "Sample Location"
      }
    ],
    "subProcessorObjectionDays": 30,
    "transfersCrossBorder": true,
    "dataSecurityStandard": "ISO/IEC 27001",
    "breachNotificationHours": 24,
    "deletionDays": 1,
    "auditFrequencyMonths": 12,
    "includesIndemnity": true
  },
  "format": "pdf"
}