Skip to content
papii

Document template · eu.gdpr.dpa

Data Processing Agreement

  • Render-verified
  • Legal-sensitive
  • Version 1.0.0

Controller-to-processor contract mandated by Art. 28(3) GDPR. Structured to align with the Article 28 obligations and compatible with Commission SCCs 2021/914 Module 2 for onward transfers outside the EU/EEA.

JSON Schema

Fields in this template

Data sent to the API is validated against the template’s JSON Schema before anything is rendered. This template defines 32 fields:

Field Required Type Description
agreement_reference Optional string
effective_date Optional date
controller Required object
processor Required object
main_agreement_reference Optional string Reference to the underlying services agreement this DPA annexes (e.g. 'Master Services Agreement dated 2024-06-01').
subject_matter Required string Art. 28(3) subject-matter clause — what the processor is asked to do with the data.
duration Optional string Art. 28(3) duration — usually 'term of the main agreement' plus any wind-down period.
processing Required object
processing.nature_and_purpose Required string
processing.data_subjects Required array of string
processing.data_categories Required array of string
processing.special_categories Optional array of string
sub_processors Optional array of object Approved sub-processors at the time of signing. Additions require notice per Art. 28(2) + the controller's right to object.
sub_processors[].name Required string
sub_processors[].service Required string
sub_processors[].location Optional string
sub_processor_notice_period_days Optional integer Days of advance notice for new or replacement sub-processors. 30 is the de-facto market norm; shorter is controller-unfriendly.
security_measures Required array of string Annex II equivalent — technical and organisational measures per Art. 32.
international_transfers Optional array of object
international_transfers[].country Required string
international_transfers[].safeguard Required string
breach_notification_hours Optional integer Hours within which the processor must notify the controller of a personal data breach. 48 is typical; anything over 72 undermines the contr…
audit_rights Optional string Scope of the controller's audit rights (direct audit, third-party auditor, frequency, cost allocation).
return_or_deletion Optional enum Art. 28(3)(g) — at end of services, processor returns or deletes. 'controller_choice' is the default.
term Required object
term.governing_law Required string
term.jurisdiction Required string
signatures Optional object
signatures.controller_signatory Optional string
signatures.controller_title Optional string

+2 more fields — the full JSON Schema is available in the dashboard and via the API.

POST /render

Generate it

One POST /render call: send your JSON, get the finished PDF back. Or skip the JSON entirely and describe the document in plain language on chut.app.

curl 
curl -X POST https://api.papii.eu/render \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "eu.gdpr.dpa",
    "data": { ... },
    "options": {"language": "en"}
  }' -o dpa.pdf
Generate with AI on chut.app Try in the dashboard

Frequently asked questions

What is “Data Processing Agreement”?

Controller-to-processor contract mandated by Art. 28(3) GDPR. Structured to align with the Article 28 obligations and compatible with Commission SCCs 2021/914 Module 2 for onward transfers outside the EU/EEA. On papii this document is available as template eu.gdpr.dpa: a JSON Schema plus a deterministic PDF renderer, so the same data always produces the same document.

Can I generate a Data Processing Agreement with AI?

Yes. chut.app — the AI back office papii powers — fills this template from a plain-language description: you describe the document in one sentence, the AI structures the data, papii validates it against the schema and renders the PDF. Developers can also call the papii API directly with structured JSON.

Is the Data Processing Agreement template legally compliant?

This template is render-verified: its schema, sample data and PDF output are automatically tested on every release. It is published with status “ready”, meaning it has not yet been through papii’s final legal review. Where it references specific legislation, that is stated in the template description — always have a professional check documents with legal effect before relying on them.