Data Processing Agreement
Template — South Africa
An attorney-drafted Data Processing Agreement (operator agreement) template designed specifically for South African businesses. This essential POPIA compliance document governs the relationship between a responsible party and an operator (data processor), covering processing purposes, security measures under Sections 19-22, sub-processing restrictions, breach notification obligations, cross-border transfer provisions, and data subject rights — ensuring lawful processing of personal information under the Protection of Personal Information Act 4 of 2013.
Drafted by qualified South African attorneys
Reviewed for compliance with current legislation · Last updated April 2026
Why Your Business Needs This Agreement
Regulatory Fines and Criminal Prosecution for Missing Operator Agreements
The absence of a written operator agreement is a direct and easily identifiable contravention of POPIA Section 21. Unlike other compliance failures that may require complex factual assessment, the Information Regulator can determine non-compliance simply by asking whether a written agreement exists. Administrative fines of up to R10 million under Section 109, enforcement notices under Section 95, and criminal prosecution under Section 107 (carrying up to 10 years' imprisonment) are all available remedies. For organisations with multiple operators processing personal information — cloud providers, payroll bureaux, marketing platforms, customer support services — each missing DPA represents a separate compliance failure.
Data Breaches Without Contractual Containment or Notification Procedures
When a data breach occurs at the operator level without a DPA in place, there is no contractual obligation for the operator to notify the responsible party promptly (or at all), no agreed incident response procedure, no defined cooperation obligations, and no contractual basis for the responsible party to demand information about the scope and impact of the breach. The responsible party discovers the breach late — often only when data subjects or the media report it — and cannot fulfill its Section 22 notification obligations in a timely manner. The resulting regulatory exposure is compounded: not only was there no DPA (Section 21 violation), but the breach notification was delayed (Section 22 violation), and the security measures were inadequate (Section 19 violation). A DPA with clear breach notification obligations — specifying maximum notification timeframes, required information, and cooperation obligations — enables rapid containment and compliant notification.
Operators Using Personal Information for Unauthorised Purposes
Without a DPA that restricts processing to documented instructions and specified purposes, operators may use personal information for their own benefit — aggregating data across clients for analytics, using customer data for product development, selling data insights to third parties, or using contact information for the operator's own marketing. These activities violate POPIA's purpose limitation principle (Section 13) and the responsible party's duty to ensure lawful processing by its operators (Section 21). The responsible party may be unaware of the unauthorised processing until a data subject complaint or regulatory investigation reveals it — by which time the damage is done and the regulatory exposure is established.
Cross-Border Data Transfers Without Adequate Safeguards
Many South African businesses use international cloud services and SaaS platforms that process and store data in jurisdictions outside South Africa. Without a DPA that addresses the Section 72 cross-border transfer requirements, these transfers may violate POPIA — even if the responsible party is unaware that data is leaving South African borders. International cloud providers typically operate data centres in multiple countries and may move data between jurisdictions for operational reasons (load balancing, disaster recovery, maintenance). A DPA with clear data localisation provisions, permitted processing locations, and contractual safeguards ensures cross-border transfers comply with Section 72 while enabling the use of global technology platforms.
No Data Return or Destruction Obligations When Service Relationships End
When a service relationship with an operator ends without a DPA specifying data return and destruction obligations, the operator has no contractual duty to return the responsible party's personal information or to destroy it securely. The personal information may remain in the operator's systems indefinitely — accessible to the operator's personnel, potentially migrated to successor systems, and vulnerable to security compromises. The responsible party has lost control over its data subjects' personal information, in violation of POPIA's storage limitation principle (Section 14) and security requirements (Section 19). A DPA with clear data return and destruction provisions — specifying format, timeframes, and certification requirements — ensures that personal information is handled appropriately when the relationship ends.
Civil Liability for Data Subject Harm Without Contractual Indemnification
Under POPIA Section 99, any person who suffers damage due to a violation of the Act may institute civil proceedings for compensation against the responsible party. If the damage was caused by the operator's actions or negligence — a data breach due to inadequate security, unauthorised disclosure of personal information, or processing outside the authorised purpose — the responsible party faces the data subject's claim but has no contractual basis for recovering from the operator without a DPA containing indemnification provisions. The responsible party absorbs the full cost of regulatory fines, data subject compensation, investigation costs, and remediation expenses. A DPA with clear liability allocation and indemnification provisions ensures that the operator bears appropriate responsibility for losses arising from its own violations.
What is a Data Processing Agreement?
Under the Protection of Personal Information Act 4 of 2013 (POPIA), whenever a responsible party — the organisation that determines the purpose and means of processing personal information — engages an operator (a third party that processes personal information on its behalf), a written contract must be in place. This Data Processing Agreement, known in South African legal terminology as an operator agreement, is not merely a best practice — it is a mandatory compliance document under Section 21 of POPIA. Without it, both parties face regulatory sanctions from the Information Regulator, including administrative fines of up to R10 million under Section 109 and criminal penalties of up to 10 years' imprisonment under Section 107.
The scope of POPIA is broad. "Personal information" under Section 1 includes any information relating to an identifiable, living natural person or an identifiable existing juristic person — covering not only obvious categories like names, ID numbers, and contact details, but also biometric information, financial information, employment history, criminal records, health information, and even the personal opinions of third parties about the data subject. "Processing" is equally broad, encompassing any operation performed on personal information — collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, consultation, use, dissemination, distribution, merging, restriction, degradation, erasure, or destruction. Any business that shares personal information with a third-party service provider is almost certainly engaging in processing that requires a Data Processing Agreement.
Section 19 of POPIA requires the responsible party to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures to prevent loss, damage, or unauthorised destruction of personal information, and to prevent unlawful access to or processing of personal information. These measures must be appropriate having regard to generally accepted information security practices and procedures applicable to the industry, the nature of the personal information being protected, the risks of harm from a security compromise, and the cost of implementing the safeguards. The DPA must specify the security measures the operator is required to implement, ensuring they meet this standard.
Section 22 imposes a mandatory breach notification obligation. Where there are reasonable grounds to believe that personal information has been accessed or acquired by any unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects as soon as reasonably possible. The operator's obligation under the DPA is to notify the responsible party without unreasonable delay upon becoming aware of any security compromise, providing sufficient information for the responsible party to fulfill its Section 22 notification obligations.
The Information Regulator has been increasingly active in enforcement, with the first enforcement notices issued in 2022 and an expanding programme of compliance assessments targeting sectors with significant personal information processing — financial services, healthcare, telecommunications, and large-scale commercial data processors. The Regulator has publicly stated that the absence of written operator agreements is a common compliance failure and a priority area for enforcement action.
This attorney-drafted template addresses every POPIA requirement for operator agreements: clear identification of the responsible party and operator, specified processing purposes and documented instructions, comprehensive security measures under Section 19, mandatory breach notification procedures under Section 22, sub-processing restrictions and approval mechanisms, cross-border transfer safeguards under Section 72, data subject rights assistance, audit and inspection rights, data retention and destruction obligations, and the consequences of termination. Whether you are a cloud computing customer, an employer outsourcing payroll, a business using external marketing platforms, or any organisation sharing personal information with third-party service providers, this DPA provides the legal foundation for POPIA-compliant data processing arrangements.
Who Needs This
Want early access to the Data Processing Agreement template?
We'll email you the moment early access opens
POPIA Section 21 makes written operator agreements mandatory — the Information Regulator has identified missing DPAs as a common compliance failure and priority enforcement area
Administrative fines of up to R10 million under Section 109 and criminal penalties of up to 10 years' imprisonment under Section 107 apply to POPIA violations including the absence of a DPA
Section 22 requires breach notification to the Information Regulator and affected data subjects as soon as reasonably possible — the DPA establishes the operator's obligation to enable this
Section 72 restricts cross-border transfers of personal information — critical for any business using international cloud services or SaaS platforms
Under Section 99, data subjects can institute civil proceedings for damages caused by POPIA violations — a DPA with indemnification provisions ensures the operator bears appropriate liability
Key Clauses Included
This Data Processing Agreement template covers 11 essential sections, each drafted by South African attorneys.
Definitions, Roles, and Scope of Processing
Establishes the POPIA-defined roles with precision — identifying the responsible party (the organisation determining the purpose and means of processing) and the operator (the third party processing on the responsible party's instructions). This section specifies the categories of data subjects affected (customers, employees, prospects, website visitors), the types of personal information being processed (contact details, financial information, identity numbers, biometric data, health information, employment records), the permitted processing purposes, and the duration of processing. Clarity on these definitions is critical — the Information Regulator uses these parameters to assess compliance and scope any enforcement action.
Processing Instructions and Purpose Limitation
Requires the operator to process personal information only on documented instructions from the responsible party and only for the explicitly defined purposes. Processing for the operator's own purposes — including data analytics, product improvement, marketing, or profiling — is strictly prohibited unless separately authorised. The section establishes the mechanism for issuing instructions (written instructions from authorised representatives), the operator's obligation to inform the responsible party if an instruction appears to violate POPIA, and the consequences of processing outside the permitted scope. This implements the POPIA Section 13 purpose limitation principle and the Section 21 requirement that the operator acts only on the responsible party's authority.
Security Safeguards and Technical Measures
Specifies the technical and organisational security measures the operator must implement under POPIA Section 19 to secure personal information against loss, damage, unauthorised destruction, and unlawful access or processing. Technical measures include encryption of personal information at rest and in transit (minimum AES-256 and TLS 1.2/1.3), access controls with role-based permissions and multi-factor authentication, network security measures (firewalls, intrusion detection/prevention systems), regular vulnerability assessments and penetration testing, secure data disposal procedures, and backup and disaster recovery capabilities. Organisational measures include information security policies and procedures, employee training and awareness programmes, background checks for personnel with access to personal information, incident response plans, and regular security audits. The measures must be appropriate having regard to the sensitivity of the information and current industry best practices.
Sub-Processing Restrictions and Approval
Restricts the operator from engaging sub-processors (sub-operators) to process personal information without the responsible party's prior specific or general written consent. Where general authorisation is given, the operator must notify the responsible party of any intended addition or replacement of sub-processors, providing the responsible party with an opportunity to object. The operator must impose equivalent data protection obligations on all sub-processors through a written agreement, and remains fully liable for the sub-processor's compliance. The section includes a list of currently approved sub-processors with their processing activities and locations. This provision is essential because personal information often flows through multiple tiers of processing — cloud providers using infrastructure sub-processors, payroll providers using tax calculation services, and CRM platforms using email delivery services.
Data Breach Notification and Incident Response
Establishes the operator's obligation to notify the responsible party of any security compromise without unreasonable delay — the template specifies a maximum notification window of 72 hours from discovery, aligned with the emerging regulatory expectation. The notification must include the nature of the breach, the categories and approximate number of data subjects affected, the categories and approximate number of personal information records affected, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects. The operator must cooperate with the responsible party's investigation and provide ongoing updates. The responsible party then fulfils its Section 22 obligation to notify the Information Regulator and affected data subjects. The section also addresses containment procedures, evidence preservation, and the operator's role in the responsible party's incident response plan.
Data Subject Rights Assistance
Requires the operator to assist the responsible party in fulfilling its obligations to data subjects under POPIA — including the right to access personal information (Section 23), the right to request correction or deletion (Section 24), the right to object to processing (Section 11(3)(a)), and the right to complain to the Information Regulator (Section 74). The operator must promptly redirect any data subject requests received directly to the responsible party and must implement technical and organisational measures that enable the responsible party to respond to data subject requests within the timeframes prescribed by POPIA. For large-scale processing operations, this may require specific system capabilities such as data export, search, and deletion functionality.
Cross-Border Transfer Provisions
Addresses the conditions under which personal information may be transferred outside the Republic of South Africa, in compliance with POPIA Section 72. Cross-border transfers are only permitted where the recipient country has adequate data protection legislation, the data subject has consented to the transfer, the transfer is necessary for the performance of a contract between the data subject and the responsible party, the transfer is for the benefit of the data subject and consent cannot reasonably be obtained, or the responsible party has taken reasonable measures to ensure the recipient will process the information in accordance with POPIA's conditions. For cloud-based processing where data may transit through or be stored in multiple jurisdictions, the section includes specific provisions for data localisation requirements, permitted storage locations, and the operator's obligations regarding data sovereignty.
Audit, Inspection, and Compliance Verification
Grants the responsible party the right to audit and inspect the operator's processing activities, security measures, and compliance with the DPA — either directly or through an independent third-party auditor. The audit scope includes security assessments, data handling practices, sub-processor compliance, breach response readiness, and policy adherence. The section specifies notice requirements (typically 20-30 business days for standard audits, with immediate access for breach investigations), the frequency of audits (at least annually), the operator's obligation to provide access to relevant premises, systems, and personnel, and the handling of audit findings including remediation timelines for any non-compliance identified. The audit right is essential for the responsible party to demonstrate ongoing compliance with its Section 19 obligations — the responsible party cannot outsource accountability.
Data Retention, Return, and Destruction
Specifies the operator's obligations upon termination or expiry of the DPA — or upon the responsible party's written request at any time. The operator must, at the responsible party's election, return all personal information in a standard, machine-readable format (typically CSV, JSON, or XML) or securely destroy all personal information using methods that prevent reconstruction (physical destruction of media, cryptographic erasure, or data sanitisation meeting international standards such as NIST SP 800-88). The section specifies the timeframe for return or destruction (typically 30 days), the requirement for written certification of destruction signed by an authorised representative, and exceptions for personal information that the operator is required to retain by law or regulation (in which case the data protection obligations continue for the duration of retention). POPIA Section 14 requires that personal information must not be retained longer than necessary for the purpose for which it was processed.
Liability, Indemnification, and Insurance
Allocates liability for POPIA violations, data breaches, and related losses between the parties. The operator indemnifies the responsible party against losses arising from the operator's breach of the DPA or its POPIA obligations — including regulatory fines, data subject compensation claims, investigation costs, and remediation expenses. The section addresses liability caps (typically carved out from the general service agreement's liability cap for POPIA-related claims), required insurance coverages (cyber liability and professional indemnity), and the operator's obligation to mitigate the consequences of any breach. Under POPIA Section 99, any person who suffers damage due to a violation of the Act may institute civil proceedings against the responsible party or operator — making adequate liability provisions and insurance essential.
Term, Termination, and Surviving Obligations
The DPA remains in force for as long as the operator processes personal information on behalf of the responsible party — it should not have an arbitrary expiry date that allows processing to continue without contractual safeguards. The responsible party may terminate the DPA immediately if the operator commits a material breach of its data protection obligations. Upon termination, the data return and destruction obligations take effect, and certain provisions survive indefinitely — confidentiality, indemnification, and the obligation to cooperate with regulatory investigations or data subject complaints that relate to the processing period. The section also addresses the responsible party's right to instruct the operator to cease all processing immediately upon termination, with no grace period for unauthorised continued processing.
South African Law Compliance
Protection of Personal Information Act 4 of 2013
POPIA is the primary legislation requiring this agreement. Section 21 mandates a written contract where an operator processes personal information on behalf of a responsible party, establishing security measures and ensuring the operator acts only on the responsible party's instructions. Section 19 requires appropriate technical and organisational measures to secure personal information — the DPA must specify these measures. Section 20 extends the responsible party's security obligations to the operator through the written agreement. Section 22 mandates notification of security compromises to the Information Regulator and affected data subjects. Section 72 restricts cross-border transfers. Section 14 requires that personal information not be retained longer than necessary. Non-compliance carries administrative fines of up to R10 million under Section 109 and criminal penalties of up to 10 years' imprisonment under Section 107.
Electronic Communications and Transactions Act 25 of 2002
ECTA addresses the security of electronic communications and data in transit between the responsible party and operator. Section 86 criminalises unauthorised access to data, which is relevant to breach scenarios. Section 50 imposes duties on electronic service providers regarding the integrity and confidentiality of electronic communications. For DPAs governing cloud-based processing or electronic data exchange, ECTA's provisions on data messages (Section 11), electronic signatures (Section 13), and the legal recognition of electronic records provide the framework for electronic instructions, approvals, and breach notifications between the parties.
Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002
RICA is relevant where the operator processes communications data (email content, call records, messaging data) on behalf of the responsible party. Section 2 prohibits the interception of communications except with the consent of the parties or under a judicial authorisation. Where the DPA covers the processing of electronic communications data — such as email archiving services, call recording platforms, or communications monitoring tools — the operator's access to and processing of this data must comply with RICA's requirements. The DPA should specify the legal basis under RICA for the operator's access to communications data and the limitations on its use.
Cybercrimes Act 19 of 2020
The Cybercrimes Act creates criminal offences for unlawful access to computer systems (Section 2), unlawful interception of data (Section 3), and unlawful acquisition of data (Section 4). Section 52 imposes a duty on electronic communications service providers to report cybercrime offences to the South African Police Service. Where the operator operates as an electronic communications service provider or processes data through computer systems, the Cybercrimes Act creates additional reporting obligations and criminal liability for security compromises. The DPA should address the operator's obligations under the Cybercrimes Act, including its duty to report cybercrimes and to cooperate with law enforcement investigations.
Promotion of Access to Information Act 2 of 2000 (PAIA)
PAIA provides a general right of access to information held by public and private bodies, subject to certain grounds of refusal. Section 63 allows private bodies to refuse access where disclosure would constitute an unreasonable disclosure of personal information of a third party. Both the responsible party and the operator must maintain PAIA manuals under Section 51 that describe the categories of records they hold, including personal information processed under the DPA. The DPA should address the operator's obligation to assist the responsible party in responding to PAIA requests that relate to personal information processed by the operator, and the operator's obligation to maintain its own PAIA manual accurately.
South African businesses are lining up for My-Contracts — be first in when we launch
Responsible Party vs Operator Under POPIA
POPIA assigns different roles and obligations depending on who decides why data is processed versus who actually processes it. Misidentifying roles leads to compliance gaps.
| Feature | Responsible Party (Controller) | Operator (Processor) |
|---|---|---|
| Definition | The person who determines the purpose of and means for processing personal information (POPIA Section 1) | The person who processes personal information on behalf of the responsible party under a contract (POPIA Section 1) |
| Decision-making | Decides why and how personal information is collected and used | Acts only on the responsible party's documented instructions — no independent decision-making |
| POPIA accountability | Bears primary accountability for compliance with all eight conditions for lawful processing | Must comply with the operator agreement terms and POPIA security requirements (Section 19) |
| Written agreement | Must ensure a written operator agreement under Section 21 is in place before processing begins | Must not process personal information without a written mandate from the responsible party |
| Breach notification | Must notify the Information Regulator and affected data subjects under Section 22 | Must notify the responsible party without unreasonable delay — the responsible party then notifies the Regulator |
| Data subject requests | Directly responsible for responding to access, correction, and deletion requests (Sections 23-25) | Must assist the responsible party in responding to data subject requests as specified in the DPA |
| Sub-processing | Must consent to the operator engaging sub-processors and can impose conditions | Cannot engage sub-processors without the responsible party's prior written consent |
| Cross-border transfers | Must ensure Section 72 conditions are met before transferring personal information internationally | Must not transfer personal information outside South Africa without the responsible party's authorisation and appropriate safeguards |
| Liability exposure | Liable to data subjects under Section 99 for damages caused by POPIA violations — fines up to R10 million | Directly liable for security failures under Section 19 and may face fines — also liable to the responsible party under the DPA indemnity |
| Common examples | The business that collects customer data: retailer, employer, bank, healthcare provider | Cloud hosting provider, payroll bureau, marketing automation platform, IT managed service provider |
Create Your Data Processing Agreement in Minutes
Our guided wizard walks you through every clause — no legal knowledge required. Attorney-drafted, South African law compliant.
Map your data processing relationships and identify operators
Conduct a data processing inventory to identify all third parties that process personal information on your behalf. Common operators include cloud service providers, payroll bureaux, marketing platforms, CRM systems, email service providers, call centres, document management services, IT managed service providers, and payment processors. For each operator, document the categories of personal information processed, the data subjects affected, the processing purposes, and whether data is transferred outside South Africa.
Assess the risk profile and required security measures
For each operator relationship, assess the sensitivity of the personal information processed (special personal information such as health or biometric data requires heightened security), the volume of records, the potential impact of a security compromise on data subjects, and the operator's existing security posture. This risk assessment determines the appropriate level of technical and organisational measures to require in the DPA, aligned with POPIA Section 19's requirement for measures that are "appropriate" having regard to the nature of the information and the risks involved.
Customise the DPA template for each operator relationship
Complete the template by inserting the specific details of each operator relationship — the categories of personal information, processing purposes, security measures, sub-processors, data locations, and retention periods. The security measures schedule should reflect the risk assessment. For high-risk processing (sensitive personal information, large volumes, or cross-border transfers), more stringent measures and shorter breach notification timeframes are appropriate. Ensure the DPA is structured to operate alongside the main service agreement.
Negotiate and execute the DPA with each operator
Present the DPA to each operator for review and negotiation. Large international operators (cloud providers, major SaaS platforms) may insist on using their own DPA template — review these carefully against POPIA's Section 21 requirements to ensure compliance. For smaller operators, the template can typically be adopted with limited modification. Electronic signatures are valid under ECTA Section 13. Ensure the DPA is executed before any personal information is shared with the operator, and that it is linked to the underlying service agreement.
Implement ongoing monitoring and compliance management
A DPA is not a set-and-forget document. Implement the monitoring mechanisms defined in the agreement: schedule annual compliance audits, review breach notification readiness, verify sub-processor compliance, and assess the adequacy of security measures against evolving threats. Maintain a register of all DPAs with key dates (term, renewal, audit schedule). When the underlying service agreement is renewed or varied, review the DPA to ensure it remains aligned with the actual processing activities. Conduct a full DPA review whenever the scope of processing changes materially.
Frequently Asked Questions
A Data Processing Agreement (DPA), known in South African law as an operator agreement, is a legally binding contract between a responsible party and an operator that governs the processing of personal information. Under POPIA Section 21, this agreement is mandatory — not optional — whenever you share personal information with a third party that processes it on your behalf. This includes common business arrangements such as using a cloud provider that stores customer data, outsourcing payroll to a bureau that handles employee records, engaging a marketing platform that processes customer contact details, or using a call centre that handles customer inquiries. The Information Regulator has publicly identified the absence of written operator agreements as a common compliance failure and a priority enforcement area. Without a DPA, both parties face administrative fines of up to R10 million under Section 109, enforcement notices requiring compliance within specified timeframes, and in serious cases, criminal prosecution under Section 107 carrying penalties of up to 10 years' imprisonment.
What You Get With This Template
Drafted specifically for POPIA compliance — addresses every Section 21 operator agreement requirement with clause-by-clause alignment to the Act
Comprehensive security measures framework aligned with Section 19, specifying both technical and organisational safeguards appropriate for South African commercial practice
Mandatory breach notification provisions with defined timeframes and required information, enabling compliant Section 22 notifications
Sub-processing controls with prior approval mechanisms, equivalent obligation requirements, and a maintained sub-processor register
Cross-border transfer provisions addressing Section 72 requirements, including data localisation, permitted processing locations, and contractual safeguards
Audit and inspection rights enabling the responsible party to verify compliance and demonstrate due diligence to the Information Regulator
Clear data return and destruction obligations with certification requirements, addressing the POPIA Section 14 storage limitation principle
Liability and indemnification provisions ensuring the operator bears appropriate financial responsibility for violations arising from its processing activities