Data Processing Agreement (DPA) – Template
A starting point under Art. 28 GDPR — because self-hosting keeps data sovereignty with you, but you still need a contract that says so in writing.
Important notice: This is a template, not legal advice. It does not replace review by a qualified lawyer and is not tailored to your specific situation. Please have it reviewed before use and replace the bracketed placeholders with your actual details.
Preamble
This agreement specifies the parties' data-protection obligations arising from the engagement of [Placeholder: processor, e.g. the ThinkShip operator] (the “Processor”) by [Placeholder: customer] (the “Controller”). It supplements the main agreement on [Placeholder: name of the main/license agreement].
1. Subject Matter and Duration
The subject matter is the processing of personal data in connection with operating the ThinkShip platform for the Controller — in particular, for self-hosted instances, the Processor's support with setup, maintenance, and support. The duration matches the term of the main agreement.
2. Nature and Purpose, Categories of Data Subjects and Data
Nature and purpose: [Placeholder: e.g. operation, maintenance, and support of a
self-hosted workflow/agent platform; processing takes place exclusively within infrastructure
operated by the Controller, not in a shared cloud environment run by the Processor.]
Categories of data subjects: [Placeholder: e.g. the Controller's employees,
customers, depending on the workflows in use.]
Types of data: [Placeholder: e.g. contact data, case/record data, possibly special
categories — depending on actual use.]
3. Technical and Organizational Measures (TOMs)
The Processor implements the measures required under Art. 32 GDPR. Because the ThinkShip platform is self-hosted, responsibility for infrastructure-level measures (physical access, physical security, network segmentation) rests mainly with the Controller as the infrastructure operator; the Processor is responsible for the application and process level (including role/permission model, encryption, logging). The specific TOMs are described in [Placeholder: Annex 1 — TOM document].
4. Rectification, Restriction, and Erasure of Data
The Processor may rectify, erase, or restrict the processing of personal data only on documented instructions from the Controller, unless required to process the data under EU or member-state law.
5. Processor Obligations
The Processor processes personal data solely within the agreed scope or on the Controller's instructions (Art. 28(3)(a) GDPR), ensures confidentiality under Art. 28(3)(b) and Art. 29 GDPR, and supports the Controller in fulfilling data-subject rights (Art. 12–23 GDPR) and data-protection impact assessments (Art. 35, 36 GDPR), to the extent agreed.
6. Sub-processors
Engaging sub-processors requires the Controller's prior written or documented consent. Current sub-processors: [Placeholder: list, e.g. “none, fully self-hosted” or specific providers with purpose and location]. Cloud AI providers that the Controller connects directly using its own key are not sub-processors of the Processor, but a separate processing relationship between the Controller and that provider.
7. Controller's Audit Rights
The Controller may verify the Processor's compliance with the obligations set out in this agreement, including by requesting information and reviewing available evidence. Since the platform is self-hosted, this mainly concerns the software and support provided by the Processor, not the Controller's own infrastructure.
8. Notification of Breaches
The Processor notifies the Controller without undue delay, and no later than [Placeholder: e.g. 48 hours] after becoming aware, of any personal data breach within its area of responsibility, and supports the Controller in meeting its obligations under Art. 33, 34 GDPR.
9. Right to Issue Instructions
The Controller issues instructions in writing or text form as a rule. Verbal instructions must be confirmed in writing without delay. The Processor informs the Controller without delay if it believes an instruction violates data-protection law.
10. Deletion and Return After Termination
After the agreed services end, the Processor deletes all personal data processed within its own area of responsibility (e.g. support tickets, diagnostic data), or returns it at the Controller's choice, unless a statutory retention obligation applies. Since core data remains on the Controller's self-hosted infrastructure, this primarily concerns data the Processor accessed during support/maintenance.
11. Liability
The statutory liability provisions of Art. 82 GDPR apply, supplemented by the liability provisions agreed in the main agreement to the extent legally permissible. [Placeholder: add liability caps / exclusions after individual review, if applicable.]
12. Final Provisions
Amendments to this agreement require written or text form. In case of conflict between this agreement and the main agreement, this agreement prevails with respect to the processing of personal data. Should any provision be invalid, the validity of the remaining provisions is unaffected.
[Placeholder: place, date, Controller's signature] · [Placeholder: place, date, Processor's signature]
Questions about your specific setup?
With self-hosting in particular, how TOMs are split depends on the operating model. Get in touch and we'll work through it together for your case.