Data Processing Agreement | 11 CCR 7051 & GDPR Art. 28

A data processing agreement is a written contract between the party that decides why personal data is collected and the party that handles it on that party's behalf. European law calls them the controller and the processor. California uses a different vocabulary for the same relationship: a business discloses personal information to a service provider or a contractor for a business purpose. The paper is titled a DPA either way, so a good template defines both sets of terms and maps them to each other.

Three documents get confused with it. An NDA stops a vendor from telling anyone your secrets but says nothing about purpose limitation, deletion, or subprocessors, so it satisfies no privacy statute. A privacy policy is a public disclosure to consumers, not a contract between two companies. A HIPAA business associate agreement under 45 CFR 164.504(e) reaches protected health information only, and a healthcare vendor usually needs both. The DPA sits underneath your commercial terms rather than replacing them, so attach it to the master services agreement that governs the engagement and inherit the term, governing law, and liability cap by reference.

California sets the strictest US bar. Civil Code section 1798.100(d) requires a written contract before a business discloses personal information to a service provider, and 11 CCR section 7051(a) lists the mandatory terms: the specific business purposes, a ban on using the data outside the direct business relationship, a bar on combining it with data from other sources, a flow down obligation on subcontractors, and a right to monitor compliance. The sanction sits in section 7050(e).

Without a compliant contract the recipient is not a service provider at all, and the disclosure can be treated as a sale or a share that consumers may opt out of. Contractors must also certify in the contract that they understand those restrictions. The nine required terms appear in the Cornell Legal Information Institute copy of the section 7051 service provider contract rules.

European exposure comes through a different door. Article 28(3) GDPR fixes eight terms every processor contract must contain, Article 28(2) conditions subprocessing on the controller's authorization, and Article 33(2) makes the processor alert the controller without undue delay. Transfers out of the EEA are papered with Commission Implementing Decision (EU) 2021/914, using Module Two for controller to processor flows and Module Three when your vendor passes data further down the chain. Clause 14 forces a transfer impact assessment; Clause 15 obliges the importer to report government demands for access. The EU US Data Privacy Framework is an alternative for certified importers and survived its first challenge in Latombe v Commission, with an appeal now pending before the Court of Justice. A data processing agreement never transfers your liability to the vendor, and regulators pursue the controller first. Its public facing companion is your privacy policy drafted to CCPA and CPRA disclosure duties, and the two must describe the same data flows.

The ordinary trigger is procurement. You are about to route customer records, payroll files, or support tickets through an outside platform, and the vendor's terms say nothing about deletion or subprocessors. The mirror image is just as common: an enterprise buyer sends you a fifteen page DPA drafted by its own counsel and you need a position of your own. Offering your house paper first beats any redline you will write later.

Human resources work is the quiet trap. Payroll bureaus, benefits brokers, background check firms, and applicant tracking systems all process personal information, and California reaches employee records where most state statutes exempt them, so an employment documents package built for US employers that omits vendor privacy terms leaves a real gap. Two edge cases deserve flagging. A vendor that wants your customer data to train its own models is processing for its own purpose, which breaks service provider status and needs an express carve out or a flat prohibition. The other is the US only company that lands its first Irish customer. GDPR follows the data, not the incorporation certificate.

• The scope and instruction clause records the subject matter, duration, nature and purpose of processing, the categories of personal data, and the categories of data subjects. Article 28(3) GDPR and Texas Business and Commerce Code section 541.104(b) both demand this specificity, and vagueness here is the usual reason a DPA fails audit.
• The purpose limitation and no sale clause bars use or disclosure outside the direct business relationship, blocks combination with outside data, and confirms that no valuable consideration is exchanged. This language preserves service provider status under 11 CCR section 7051.
• The subprocessor clause sets general or specific authorization, gives you notice and a right to object before a new subprocessor is engaged, flows equivalent terms down in writing, and keeps the vendor liable for its subcontractors.
• The security clause commits the vendor to defined technical and organizational measures rather than a promise of reasonableness: encryption in transit and at rest, access control, logging, and confidentiality duties surviving termination.
• The incident notification clause fixes a deadline shorter than the regulatory one, requires the vendor to supply the facts you need for your own state breach notifications, and bars unilateral public statements.
• The assistance, audit, and deletion clause covers consumer and data subject requests, data protection assessments, an annual audit or an independent assessor report in the alternative, and return or deletion of every copy with certification. Read it against the SaaS and software license agreement template, which allocates the same risks from the opposite direction.

California is the outlier and the drafting anchor. 11 CCR section 7051 is the most prescriptive processor contract rule in the country, the CCPA alone reaches employee and job applicant data, and Civil Code section 1798.150 gives consumers a private right of action for breaches of unencrypted personal information caused by unreasonable security. That statutory damages exposure is why California vendors negotiate hardest over the security schedule. Draft to California first and the rest of the country generally follows.

Texas applies the Texas Data Privacy and Security Act with no revenue threshold, so small companies fall in unless they qualify under section 541.107. Section 541.104(b) mandates the contract terms and 541.104(c) lets a vendor substitute a qualified independent assessor's report for a customer audit. House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, amended section 541.104 to reach personal data processed by an artificial intelligence system, so AI vendors selling into Texas must say so in the processing description.

Virginia is the model most other states copied. Virginia Code section 59.1-579 requires processing instructions, confidentiality duties, deletion or return at the customer's election, and cooperation with assessments. It exempts employee and business to business data, so a Virginia only analysis understates your California obligations.

Colorado adds detail through the Attorney General's rules at 4 CCR 904-3, read with section 6-1-1305(5) of the Colorado Privacy Act, and says plainly that a processor becomes a controller once it decides purposes and means on its own. Connecticut tracks the same structure at section 42-520, and its cure period has now sunset, so the Attorney General can act on a first violation without giving you a window to fix it. Related paperwork sits in the US business contracts and incorporation documents catalog.

You begin by identifying which side of the relationship you are on, because the template branches from there. Customer produces a controller favorable draft with tighter subprocessor control and a short notification window; vendor relaxes the audit mechanics and adds the independent assessor alternative that Texas and Virginia permit. Next you describe the processing itself. The form asks for the categories of personal data, the categories of individuals, the business purposes, and the retention period, then writes them into the schedule regulators read first.

You then select your governing statutes. California adds the service provider language, the combination prohibition, and the contractor certification. Any European exposure attaches the Article 28 terms and prompts you to pick the transfer module, with the annexes pre-populated from answers you already gave. Last, you list your subprocessors, set the notification deadline in hours, and choose between deletion and return at termination. The agreement downloads in editable Word and signature ready PDF, with schedules kept as separate exhibits.

The costliest mistake is treating the DPA as boilerplate and leaving the processing description generic. Regulators read the schedule before the clauses, and a line saying only that the vendor provides services supports neither service provider status nor an Article 28 defense. Close behind is granting a broad right to use aggregated, anonymized, or derived data for product improvement. That language is standard in supplier paper and it is where model training gets smuggled in. Data that can be re-identified is still personal information, and a right to use it for the vendor's own purposes destroys service provider status.

Notification timing is the third recurring failure. Vendors offer to notify without undue delay because that is the statutory phrase, but the controller carries the seventy two hour clock and cannot start it until the vendor calls. Fix a number of hours instead. The fourth is a stale subprocessor annex listing three cloud providers when the vendor now uses eleven, breaching the flow down obligation every state statute imposes. Last, companies pick the wrong transfer module, using controller to processor clauses when their vendor is itself a processor passing data onward. Get that wrong and the transfer has no legal basis.