FreelanXData processing addendum (GDPR art. 28)
The data processing terms required by Article 28(3) GDPR, clause by clause, for a contractor or freelancer who handles personal data for you, with the UK, California, India and Brazil equivalents.
This addendum ("DPA") forms part of the agreement dated [date] (the "Agreement") between [Client] (the "Controller") and [Contractor] (the "Processor").
| Item | Details |
|---|---|
| Subject matter and duration | Performance of the Services under the Agreement, for its duration |
| Nature and purpose | [e.g. hosting, development and testing on production data, customer support] |
| Types of personal data | [e.g. names, email addresses, usage data] |
| Categories of data subjects | [e.g. customers, employees of the Controller] |
| Special categories | [None / describe and add safeguards] |
| Sub-processors approved at signature | [Name, country, service] |
2.1 The Processor processes personal data only on documented instructions from the Controller, including for transfers to third countries, unless required by law; it informs the Controller of that legal requirement before processing, unless the law forbids it.
2.2 The Processor immediately informs the Controller if, in its opinion, an instruction infringes data protection law.
The Processor ensures that persons authorised to process the personal data have committed to confidentiality or are under a statutory obligation of confidentiality.
The Processor implements the technical and organisational measures required by Article 32 GDPR, listed in the Annex, including as appropriate encryption, access control, ability to restore availability, and regular testing.
5.1 The Processor does not engage another processor without the Controller's [prior specific / general] written authorisation. Under a general authorisation, it informs the Controller of any intended change at least [30] days in advance, giving the Controller the opportunity to object.
5.2 The Processor imposes the same data protection obligations on each sub-processor by contract and remains fully liable for its performance.
6.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate measures in responding to requests from data subjects exercising their rights.
6.2 The Processor assists the Controller with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).
The Processor notifies the Controller without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach, with the information required by Article 33(3) GDPR as it becomes available.
At the choice of the Controller, the Processor deletes or returns all personal data at the end of the Services and deletes existing copies, unless law requires storage, and certifies it in writing.
The Processor makes available all information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, by the Controller or an auditor it mandates, on reasonable notice.
Personal data is transferred outside the EEA or the UK only with appropriate safeguards: an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, module [two / three]) or, for the UK, the International Data Transfer Agreement or Addendum, together with any supplementary measures needed.
If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails.
Annex – Technical and organisational measures. [Access control and least privilege; multi-factor authentication; encryption in transit and at rest; logging and monitoring; backups and restore tests; secure development; vulnerability management; incident response; staff training; deletion procedure.]
Signed for the Controller: ______________________ Signed for the Processor: ______________________
Step by step
- 1Copy the document and complete every [bracket].
- 2Read the practice notes for the countries concerned and adapt the clauses they mention.
- 3Have the signatories read it, then sign it electronically.
Watch-outs
What changes from one country to another, with the legal source.
A processor contract must cover the eight points of Article 28(3); transfers outside the EEA need safeguards such as the 2021 SCCs.
GDPR, art. 28(3), 44-46; Decision (EU) 2021/914Same Article 28 content; international transfers use the IDTA or the UK Addendum.
UK GDPR, art. 28; ICO guidanceService provider and contractor contracts must include the statutory terms.
Cal. Civil Code § 1798.100(d); 11 CCR § 7051Data fiduciaries engage processors only under a valid contract.
DPDP Act 2023, s 8(2)Processors follow the controller's instructions.
LGPD (Lei 13.709/2018), art. 39Processors must follow the controller's instructions and protect data under the federal law (outside DIFC and ADGM, which have their own laws).
Federal Decree-Law No. 45 of 2021, art. 8; DIFC Data Protection Law 2020Legal references checked on 15 Oct 2026. Rules change: check the source before you rely on it.
Questions people ask
Does every freelancer need a DPA?
Only when they process personal data on your behalf, for example access to customer data in a database. A designer working on a logo usually does not.
Is it free?
Yes. Every template is free to read and copy: no sign-up, no email, no download.
Is this legal advice?
This template is for information and does not constitute legal advice; adapt it to your situation and local law.