Business contractsAgreement
Data processing agreement (DPA) template
When a supplier handles personal data for you, data protection law expects a written contract with specific terms. This DPA covers them: instructions, confidentiality, security, sub-processors, breaches and deletion.
Opens in the Salsox editor with 6 signing fields already placed for Processor and Controller. Add their emails and send. The free plan sends 3 documents a month.
Who signs
- Processor (you)
- Controller
Preview
Data Processing Agreement
This agreement is made on 24 October 2026 between Fernhill Dental Group Ltd, of 3 Station Approach, Bristol BS1 6QF, United Kingdom (the "Controller"), and Appointly Software Ltd, of 45 Queen Street, Edinburgh EH2 3NH, United Kingdom (the "Processor"). It forms part of the Appointly subscription agreement dated 1 October 2026 (the "Main Agreement").
1. Details of the processing
| Purpose | providing online appointment booking, reminders by email and SMS, and patient check-in |
| Data subjects | the controller's patients and prospective patients, and the controller's staff who use the service |
| Types of personal data | name, contact details, date of birth, appointment history and notes the controller chooses to add |
| Special category data | health information contained in appointment notes |
| Duration | the term of the main agreement, plus up to 30 days for deletion |
2. Instructions
The Processor will process personal data only on the Controller's documented instructions, including those in the Main Agreement, unless the law requires otherwise, in which case it will tell the Controller first unless the law forbids it. The Processor will tell the Controller if it believes an instruction breaks data protection law.
3. Confidentiality
The Processor will ensure everyone authorised to process the personal data is bound by a duty of confidentiality.
4. Security
The Processor will implement appropriate technical and organisational measures to protect the personal data, including encryption in transit and at rest, single sign-on with two-factor authentication for staff, role-based access, daily encrypted backups and annual penetration testing, and will keep them under review.
5. Sub-processors
The Controller authorises the following sub-processors: Amazon Web Services EMEA SARL for hosting in Ireland, and Twilio Inc. for SMS delivery. The Processor will give the Controller at least 30 days' notice of any new sub-processor, during which the Controller may object on reasonable grounds. The Processor will impose the same data protection obligations on each sub-processor and remains liable for their performance.
6. Assistance
Taking into account the nature of the processing, the Processor will help the Controller respond to requests from data subjects exercising their rights, and with security, breach notification, impact assessments and consultation with regulators.
7. Personal data breaches
The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its own obligations.
8. International transfers
The Processor will not transfer personal data outside the United Kingdom or the European Economic Area unless a lawful safeguard is in place, namely the UK International Data Transfer Addendum to the EU standard contractual clauses.
9. End of processing
When the Main Agreement ends, the Processor will, at the Controller's choice, delete or return all personal data and delete existing copies, unless the law requires it to keep them.
10. Audits
The Processor will make available the information needed to demonstrate compliance with this agreement and allow for, and contribute to, audits by the Controller or an auditor it appoints, on reasonable notice and no more than once a year unless a breach has occurred.
11. General
If this agreement and the Main Agreement conflict on data protection, this agreement prevails. It is governed by the law of England and Wales.
Signatures
For the Processor: Signature · Processor Date: Date · Processor Name: Name · Processor
For the Controller: Signature · Controller Date: Date · Controller Name: Name · Controller
These templates are general starting points, not legal advice. Laws differ between countries and states: check that a template suits your situation, or ask a lawyer, before you rely on it.
About the Data processing agreement (DPA) template
Under the GDPR, the UK GDPR and laws modelled on them, a business that uses a supplier to handle personal data on its behalf must have a written contract with that supplier covering a specific list of points. The business is the controller, deciding why and how the data is used; the supplier is the processor, acting only on the controller's instructions. That contract is the data processing agreement.
This template covers the terms such laws require: processing only on documented instructions, confidentiality of staff, security measures, conditions for using sub-processors, help with data subjects' requests, notice of breaches, deletion or return at the end, and making information available for audits. It also records the details regulators expect to see: what data, about whom, for what purpose and for how long.
It is drafted from the processor's side as a supplier would send it with its main contract, but works either way. Describe your security measures and sub-processors accurately; a DPA that promises controls you do not have creates liability rather than reducing it.
- Signers
- 2
- Signing fields placed
- 6
- Details to fill in
- 16
How to use this template
Open it in Salsox
Choose Use this template. Sign up free if you have no account; the template opens straight after.
Fill in the details
Type your details into each blank, or start from the sample to see how it reads. Save it as your own template to reuse it.
Add signers and send
The editor already has every signature, date and initials field in place. Add each signer's email and send; they sign on their phone, and everyone gets the sealed copy with its audit trail.
Used in
Questions
Do I need a DPA?
If you are subject to the GDPR or UK GDPR and a supplier processes personal data for you, such as a payroll provider, a CRM or a booking system, yes: the law requires a written contract with these terms.
Who signs the DPA, the controller or the processor?
Both. It binds the processor to the controller's instructions and records the controller's choices, so each party signs.
What about transfers outside the UK or EU?
Section 8 requires a lawful transfer mechanism, such as the standard contractual clauses or a transfer addendum, whenever data leaves the UK or EU. Name the one you rely on.
Related templates
Business contracts
Service agreement template
The general-purpose contract for a business supplying services to a client: what will be delivered and to what standard, fees and payment, how long it runs, and how it ends.
Business contracts
Consulting agreement template
The contract behind a consulting engagement: what the consultant will advise on, how they are paid, who owns the reports, and the confidentiality and non-solicitation terms clients expect.
Business contracts
Memorandum of understanding (MOU) template
Put a collaboration in writing before the full contract: the shared purpose, what each side will contribute, who leads what, and a clear line between what is binding and what is not.
Business contracts
Service level agreement (SLA) template
Turn 'reliable service' into numbers both sides can check: an uptime target and how it is measured, support hours, response times by severity, planned maintenance, and the credit owed when targets are missed.
Business contracts
Joint venture agreement template
Two businesses working together on one project need to agree who brings what, how decisions are made, how costs and profits are shared, who owns what is created, and how it ends. This contractual joint venture covers it.
Business contracts
Letter of intent (LOI) template
Set out the main terms of a deal before the full contract is drafted: what is proposed, the price, the timetable and the conditions, with a clear line between what binds both sides now and what does not.
Send it for signature in minutes
Start from this template in Salsox: fill in the blanks, add your signers and send by email, WhatsApp or SMS. Signers sign one field at a time on their phone, and you can collect a payment in the same step.