How to make a Data Processing Agreement (DPA)?

Short answer

1. 1Go to 4mycontracts.net and select the GDPR / DPA category.
2. 2Fill in controller and processor details.
3. 3Define processing purpose, data categories, and retention period.
4. 4Add security measures and list authorized sub-processors.
5. 5Send the DPA for electronic signature to both parties, through a link.

What the law says

• GDPR Art. 28 — written contract mandatory between controller and processor.
• GDPR Art. 32 — technical and organizational security measures required in DPA.
• GDPR Art. 46 — standard contractual clauses for transfers outside the EU.
• Romanian Law 190/2018 — GDPR transposition and applicable penalties.
• eIDAS Regulation (910/2014) — electronic signature validity on DPA documents.

Practical examples

• DPA between a digital marketing agency and its SaaS client for managing email lists.
• Processing agreement between a private hospital and its HIS software vendor accessing medical records.
• DPA between an online store and a payment processor storing card data.
• Controller-processor contract between an HR firm and an external cloud payroll platform.

Common mistakes

• Missing explicit list of authorized sub-processors — invalidates the DPA under Art. 28.
• Unspecified data retention period — direct GDPR obligation left uncovered.
• DPA signed after data processing has started, not before — ANSPDCP fine risk.
• Generic security clauses copy-pasted without reflecting actual technical measures in place.

How 4mycontracts helps

• DPA template structured according to GDPR art. 28, with the mandatory sections to fill in.
• A field for the sub-processor list, so you do not omit the element most often penalised.
• Simple electronic signature through a secure link — the signer needs no account.
• Archive of signed DPAs in your account, with the event history of each.
• Expiry radar in the panel: see the contracts that expire within 30 days.