Data agreements
Data handling agreement, US
In the libraryThe door has this paper. Type its name at the composer. It offers to start from it.
The data half of a services relationship, written for United States practice: what personal information changes hands, what the receiving side may do with it, and how long they keep it. It sits alongside a services agreement rather than replacing one. It usually names the categories of information involved, restricts use to providing the service, deals with subcontractors, and sets out what happens if there is a security incident.
- Printed on the page as
- Data Processing Addendum (U.S.)
- Where it can live
- Any of the 184 governing laws
Who uses one
- Suppliers handling personal information belonging to a customer's users or staff.
- Companies whose customers ask for a data addendum before signing.
- Businesses selling to organisations subject to state privacy laws.
What you are deciding
- What categories of personal information are involved
- What the receiving side may use it for, and what it may not
- Which subcontractors may see it, and on what terms
- What security measures apply
- What happens when there is an incident, and how quickly
- How long it is kept, and what happens at the end
- Whether the customer may audit, and how
Blanks you leave stay blank and wait in the room. Nothing is filled in from a guess.
The sections a draft usually has
- 1The agreement it attaches to
- 2Definitions
- 3Scope of the processing
- 4Restrictions on use
- 5Subcontractors
- 6Security measures
- 7Incident notification
- 8Return and deletion
- 9Audit
A general outline, not a required one. What turns up in a draft follows what you described. A contract is written in the order a contract is read.
What people call it
Type any of these at the door. It offers this paper. The matching happens in your own browser, on a wordlist you could read. No model runs before you sign in.
- dpa
- data processing addendum
- data processing agreement
- data handling agreement
- ccpa addendum
Questions people ask
- What is a data processing addendum attached to?
- Usually a services or subscription agreement. It is an addendum rather than a standalone contract because it depends on the commercial terms it sits under.
- Why do United States and global versions differ?
- Because the frameworks differ. State privacy laws and cross-border transfer rules impose different requirements, so the two papers are drafted for the practice they name rather than merged into one.
- Who decides what the data may be used for?
- Commonly the customer instructs and the supplier follows, and the addendum records that shape. Exactly how the roles are labelled depends on the framework that applies.
General answers about the document. Not advice about your situation. Not written about any one country.
Where it lives
A contract names the legal system it is governed by. That is a separate decision from which paper it is. You pick it at the door, from any of the 184 units in Governing law, including England and Wales, Delaware, California and New York.
Say what you agreed in one sentence. When what you describe is data handling agreement, us, the door offers this paper. One press takes it. One press refuses it.
Start it at the door →Related kinds