Data Processing Agreement (DPA)
Template — South Africa
An attorney-drafted Data Processing Agreement template designed specifically for South African businesses that need to comply with both POPIA and GDPR. This comprehensive, legally compliant document governs the relationship between the responsible party (data controller) and the operator (data processor) — covering processing instructions, security measures under POPIA Sections 19-22, cross-border transfer safeguards under Section 72, sub-processor management, breach notification, data subject rights, audit rights, and data return obligations, with dual compliance for GDPR Article 28 where applicable.
Drafted by qualified South African attorneys
Reviewed for compliance with current legislation · Last updated April 2026
Why Your Business Needs This Agreement
Processing Without a Written Operator Agreement
Many South African businesses engage cloud providers, marketing platforms, and IT support companies without a POPIA Section 21-compliant operator agreement. This is a direct violation of the law. The responsible party faces enforcement action for failing to ensure their operator is contractually bound, while the operator faces liability for processing without proper authorisation. The Information Regulator has flagged the absence of operator agreements as a priority compliance area.
Cross-Border Transfers Without Legal Basis
South African businesses routinely use international SaaS platforms that store and process data in the US, EU, or Asia — often without considering whether POPIA Section 72 permits the transfer. Without contractual safeguards in the DPA (such as standard contractual clauses), every API call to a foreign-hosted service that transmits personal information may constitute an unlawful cross-border transfer. The risk is particularly acute because the Information Regulator has not published an adequacy list, leaving contractual mechanisms as the primary lawful basis.
No Breach Notification Procedures in Place
Without a DPA that establishes clear breach notification timelines and procedures, a processor's security breach can go unreported for days, weeks, or even months. POPIA Section 22 requires notification "as soon as reasonably possible," and the responsible party cannot notify the Information Regulator or affected data subjects if they do not know about the breach. Late notification compounds the damage to data subjects, increases regulatory scrutiny, and erodes public trust.
Uncontrolled Sub-Processor Chains
Many processors engage their own sub-processors without the responsible party's knowledge or consent — creating processing chains that the responsible party cannot monitor or control. Without DPA provisions governing sub-processor engagement, the responsible party has no visibility into who is actually processing their data, where it is being stored, and what security measures are in place. This lack of control directly violates the accountability principle of POPIA and GDPR.
Data Locked After Service Termination
When a service agreement ends without a DPA that specifies data return and deletion procedures, the processor may retain personal information indefinitely — or delete it without providing the responsible party with an opportunity to export. Both outcomes create POPIA compliance problems: indefinite retention violates the purpose limitation principle of Section 14, while premature deletion may destroy records the responsible party needs for legal, tax, or business continuity purposes.
Dual POPIA-GDPR Non-Compliance
South African businesses that serve EU customers face the challenge of dual regulatory compliance. A DPA that satisfies POPIA but not GDPR — or vice versa — leaves gaps that either the Information Regulator or an EU supervisory authority can exploit. GDPR fines are significantly higher (up to EUR 20 million or 4% of global turnover), making non-compliance with EU requirements a material financial risk for South African businesses with international operations.
What is a Data Processing Agreement (DPA)?
A Data Processing Agreement (DPA) is not merely a good practice document — it is a legal requirement under both the Protection of Personal Information Act 4 of 2013 (POPIA) and the General Data Protection Regulation (EU) 2016/679 (GDPR). Whenever a business engages a third party to process personal information on its behalf — whether a cloud provider, payroll processor, email marketing platform, CRM system, IT support company, or any other service that involves accessing, storing, or manipulating personal information — both POPIA and GDPR require a written agreement governing that processing relationship. Without this agreement, both the responsible party (controller) and the operator (processor) face regulatory penalties, enforcement notices, and civil liability to affected data subjects.
Under POPIA, the obligation is clear and specific. Section 21(1) provides that an operator may only process personal information with the knowledge and authorisation of the responsible party, and must treat the personal information as confidential. Section 21(2) requires the operator to establish and maintain security measures referenced in Section 19. Section 19 itself is the cornerstone provision: it requires both the responsible party and the operator to secure the integrity and confidentiality of personal information by implementing "appropriate, reasonable technical and organisational measures" to prevent loss, damage, unauthorised destruction, unlawful access, or unlawful processing. Section 22 imposes mandatory breach notification obligations — where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, both the responsible party and the Information Regulator must be notified "as soon as reasonably possible."
Section 72 of POPIA adds a critical dimension for South African businesses that use processors located outside the country. Cross-border transfers of personal information are only permitted where the recipient country has been determined to have "adequate" data protection legislation, where the transfer is subject to binding corporate rules, where the data subject has consented, or where the transfer is necessary for the performance of a contract. The Information Regulator has not yet published a formal adequacy list, which means South African businesses must rely on contractual safeguards — typically standard contractual clauses incorporated into the DPA — to legitimise cross-border transfers to their processors. This is particularly relevant for businesses using global SaaS platforms (AWS, Microsoft Azure, Google Cloud, Salesforce, HubSpot, Mailchimp) where data is processed and stored outside South Africa.
For South African businesses that also serve European clients or process EU personal data, the GDPR applies concurrently with POPIA. GDPR Article 28 contains detailed and prescriptive requirements for controller-processor agreements, including specific provisions that must be included verbatim. The GDPR's extraterritorial reach under Article 3(2) means that any South African business offering goods or services to EU data subjects, or monitoring their behaviour, must comply with GDPR regardless of where the business is incorporated. This template is structured for dual POPIA-GDPR compliance, mapping the terminology and requirements of both frameworks side by side: "responsible party" (POPIA) maps to "controller" (GDPR), "operator" (POPIA) maps to "processor" (GDPR), "security compromise" (POPIA) maps to "personal data breach" (GDPR).
This attorney-drafted template covers every mandatory element of a data processing agreement under both POPIA and GDPR: definitions and role identification, processing scope and instructions, processor obligations and restrictions, security measures, sub-processor management, breach notification procedures, cross-border transfer mechanisms, data subject request handling, audit rights, data impact assessment assistance, and data return or deletion on termination. It is structured for clickwrap acceptance — making it ideal for SaaS platforms, online services, and digital businesses that need customers to accept data processing terms as part of their onboarding workflow.
Who Needs This
Want early access to the Data Processing Agreement (DPA) template?
We'll email you the moment early access opens
POPIA Section 21 requires a written agreement between the responsible party and operator before processing begins — non-compliance can result in administrative fines of up to R10 million under Section 109 and criminal penalties of up to 10 years imprisonment under Section 107
POPIA Section 72 restricts cross-border transfers of personal information — the Information Regulator has not published an adequacy list, making contractual safeguards the primary mechanism for legitimising international data transfers
GDPR Article 28 contains the most prescriptive controller-processor agreement requirements in global data protection law — and applies to South African businesses serving EU customers under the GDPR's extraterritorial reach in Article 3(2)
GDPR administrative fines can reach EUR 20 million or 4% of annual global turnover — significantly exceeding POPIA's R10 million maximum, making GDPR compliance a material financial risk for South African businesses with international operations
Security compromises may simultaneously trigger POPIA Section 22 notification, GDPR Article 33 notification, and Cybercrimes Act Section 54 reporting obligations — the DPA must address all three frameworks for comprehensive compliance
Key Clauses Included
This Data Processing Agreement (DPA) template covers 12 essential sections, each drafted by South African attorneys.
Definitions & Role Identification
Clear identification of the responsible party (POPIA) / controller (GDPR) and the operator (POPIA) / processor (GDPR), mapping the terminology of both frameworks. Defines key terms including personal information, special personal information, processing, data subject, security compromise (POPIA) / personal data breach (GDPR), and Information Regulator / supervisory authority. Establishes that the DPA supplements the underlying service agreement and prevails in case of conflict on data protection matters.
Processing Scope & Documented Instructions
Specifies the categories of personal information to be processed (contact details, financial data, employee records, health information, etc.), the categories of data subjects (customers, employees, website visitors, minors), the purposes of processing, and the duration. Establishes that the operator may only process personal information in accordance with the responsible party's documented instructions — unless required by law to do otherwise, in which case the operator must inform the responsible party before processing (unless legally prohibited from doing so). This section satisfies POPIA Section 21(1) and GDPR Article 28(3)(a).
Operator/Processor Obligations
Comprehensive obligations binding the operator: processing only on documented instructions, ensuring personnel are bound by confidentiality agreements, implementing security measures as specified in the agreement, engaging sub-processors only with prior authorisation, assisting the responsible party with data subject requests and regulatory enquiries, deleting or returning all personal information on termination, and making available all information necessary to demonstrate compliance with the agreement. Includes the operator's duty to inform the responsible party if an instruction would violate POPIA or GDPR.
Security Measures
Specifies the technical and organisational security measures the operator must implement — mapped to POPIA Section 19 and GDPR Article 32. Includes encryption of personal information at rest (AES-256) and in transit (TLS 1.2+), access controls with role-based permissions and multi-factor authentication, pseudonymisation and anonymisation where appropriate, regular vulnerability assessments and penetration testing, incident response procedures, backup and disaster recovery measures, and the requirement to regularly test, assess, and evaluate the effectiveness of these measures. The measures must be appropriate to the risk, taking into account the state of the art, costs, and the nature, scope, context, and purposes of processing.
Sub-Processor Management
Governs the engagement of sub-processors (sub-operators) by the operator. Provides two consent models: specific prior authorisation (the responsible party approves each sub-processor individually) or general authorisation with notification and objection rights (the operator provides a list of current sub-processors and notifies the responsible party of any additions, with the responsible party having the right to object). Requires the operator to impose equivalent data protection obligations on sub-processors through written contracts. Establishes that the operator remains fully liable for the acts and omissions of its sub-processors. Satisfies GDPR Article 28(2) and (4).
Security Compromise / Breach Notification
Establishes the operator's obligation to notify the responsible party of any security compromise (POPIA) or personal data breach (GDPR) without undue delay — the template specifies notification within 72 hours of the operator becoming aware of the breach, aligning with GDPR Article 33's timeline. The notification must include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to mitigate the effects. The responsible party is then responsible for notifying the Information Regulator (POPIA Section 22) or supervisory authority (GDPR Article 33) and affected data subjects (POPIA Section 22(4) / GDPR Article 34) where required.
Cross-Border Transfers
Mechanisms for lawfully transferring personal information outside South Africa (POPIA Section 72) or outside the EEA (GDPR Chapter V). Specifies the countries where data will be processed and stored, the legal basis for each transfer (adequacy decision, standard contractual clauses, binding corporate rules, consent, or contractual necessity), and the additional safeguards in place. The template includes the option to incorporate standard contractual clauses (SCCs) as an annex. For POPIA, given the Information Regulator's lack of a published adequacy list, contractual safeguards are the primary mechanism for legitimising cross-border transfers from South Africa.
Data Subject Rights & Request Handling
The operator's obligation to assist the responsible party in responding to data subject requests — including access (POPIA Section 23 / GDPR Article 15), correction (POPIA Section 24 / GDPR Article 16), deletion (POPIA Section 24 / GDPR Article 17), restriction of processing (GDPR Article 18), data portability (GDPR Article 20), and objection (POPIA Section 11 / GDPR Article 21). Specifies the timeframe for the operator to notify the responsible party of a received request (typically within 2 business days) and the technical measures the operator must implement to facilitate request fulfilment.
Data Protection Impact Assessments
The operator's obligation to assist the responsible party in conducting data protection impact assessments (DPIAs) where required — typically when processing involves high-risk activities such as systematic profiling, large-scale processing of special personal information, or systematic monitoring of publicly accessible areas. While POPIA does not have a formal DPIA requirement equivalent to GDPR Article 35, the principle of accountability under POPIA Condition 7 supports the practice. This section is primarily relevant for GDPR compliance.
Audit Rights & Compliance Verification
The responsible party's right to audit the operator's compliance with the DPA. Covers on-site inspections of the operator's data processing facilities, review of policies, procedures, and technical controls, use of independent third-party auditors (with confidentiality protections), the audit frequency (typically once per 12-month period, plus additional audits following a security compromise), notice requirements (usually 30 days), the scope of the audit, cost allocation (typically borne by the responsible party unless the audit reveals material non-compliance), and the operator's obligation to remediate any findings within agreed timeframes.
Data Return & Deletion on Termination
The operator's obligations upon termination of the underlying service agreement — returning all personal information to the responsible party in a standard, machine-readable format, certifying deletion of all retained copies (including backups, logs, and derived datasets), and the timeframe for completion (typically 30-90 days). Specifies exceptions for legally required retention (tax records, regulatory compliance), the format and method of return (encrypted transfer, secure download), and the responsible party's right to verify deletion through an audit or certification.
Liability & Indemnification
Allocation of liability between the responsible party and the operator for data protection breaches. Under POPIA, the responsible party bears primary liability to data subjects, but can seek contribution from the operator for breaches caused by the operator's failure to comply with the DPA. Under GDPR, both controllers and processors can be held directly liable to data subjects (Article 82). The DPA should specify the operator's indemnification obligations for losses arising from the operator's breach of the agreement, including regulatory fines, compensation claims, and notification costs.
South African Law Compliance
Protection of Personal Information Act 4 of 2013
POPIA is the primary legislation governing data processing agreements in South Africa. Section 19 is the cornerstone provision — requiring both the responsible party and the operator to implement "appropriate, reasonable technical and organisational measures" to secure personal information against loss, damage, unauthorised destruction, unlawful access, or unlawful processing. Section 21 requires the operator to process only with the responsible party's knowledge and authorisation, to treat information as confidential, and to establish security measures. Section 22 mandates notification of security compromises to the Information Regulator and affected data subjects "as soon as reasonably possible." Section 72 restricts cross-border transfers, requiring adequate protection in the recipient country or specific safeguards. Section 100 grants the Information Regulator enforcement powers, and Section 109 provides for administrative fines of up to R10 million for non-compliance.
General Data Protection Regulation (EU) 2016/679
GDPR Article 28 contains the most detailed and prescriptive requirements for controller-processor agreements in global data protection law. It mandates specific provisions that must be included in the agreement, including processing only on documented instructions, confidentiality obligations, security measures, sub-processor management, data subject request assistance, deletion or return on termination, compliance verification, and the duty to inform the controller of conflicting instructions. Article 28(3) lists these requirements exhaustively. The GDPR applies to South African businesses under Article 3(2) when they offer goods or services to EU data subjects or monitor their behaviour. Maximum administrative fines under GDPR are EUR 20 million or 4% of annual global turnover, whichever is higher — significantly exceeding POPIA's maximum penalties.
Electronic Communications and Transactions Act 25 of 2002
ECTA supports the enforceability of data processing agreements accepted through electronic clickwrap mechanisms. Section 11 confirms that agreements are not invalid merely because they are in electronic form. Section 22 requires that the other party has a reasonable opportunity to review the terms before acceptance. For SaaS platforms that incorporate DPA acceptance into their digital onboarding workflow, ECTA's provisions on electronic agreements validate the online acceptance process. Section 15 confirms that electronic records satisfy legal requirements for written documents — relevant to POPIA Section 21's requirement for written operator agreements.
Cybercrimes Act 19 of 2020
The Cybercrimes Act creates criminal offences for unauthorised access to personal information (Section 2), unlawful interception of data (Section 3), and cyber fraud (Section 8). Section 54 imposes reporting obligations on electronic communications service providers — including certain data processors — requiring them to report specified offences to the SAPS within 72 hours. The DPA should address the operator's obligations under the Cybercrimes Act, including incident reporting, evidence preservation, and cooperation with law enforcement. A security compromise involving personal information may simultaneously trigger POPIA Section 22 notification and Cybercrimes Act Section 54 reporting obligations.
Promotion of Access to Information Act 2 of 2000
PAIA grants individuals the right to request access to records held by both public and private bodies. Where the operator holds personal information on behalf of the responsible party, PAIA access requests may be directed to either or both parties. The DPA should address the operator's obligation to redirect PAIA requests to the responsible party and to assist in providing the requested information within the statutory timeframes. Section 50 of PAIA provides that private bodies must grant access to records if the requester is entitled to the information and the request complies with procedural requirements.
South African businesses are lining up for My-Contracts — be first in when we launch
Create Your Data Processing Agreement (DPA) in Minutes
Our guided wizard walks you through every clause — no legal knowledge required. Attorney-drafted, South African law compliant.
Map your data processing relationships
Identify every third party that processes personal information on your behalf — including cloud providers, SaaS platforms, marketing tools, payroll processors, IT support companies, and backup services. For each processor, document what personal information they access, why, where it is stored, and whether cross-border transfers are involved. This data mapping exercise is the foundation for determining which DPAs you need.
Determine the applicable regulatory framework
Assess whether your processing activities are subject to POPIA only, or to both POPIA and GDPR. If you offer goods or services to EU data subjects or monitor their behaviour, GDPR applies concurrently. If your processors are located outside South Africa, identify the legal basis for cross-border transfers under POPIA Section 72. This assessment determines the level of detail required in your DPAs.
Customise the DPA template for each processor
Complete the template by specifying the categories of personal information, the processing purposes, the security measures required, the sub-processor consent model, the breach notification timeframe, and the cross-border transfer mechanisms. For high-volume or high-sensitivity processors, negotiate specific security commitments. For lower-risk processors, the standard template may be sufficient with minimal customisation.
Integrate the DPA into your onboarding workflow
For SaaS platforms, incorporate the DPA into the clickwrap onboarding flow — presenting it alongside the Terms of Service and Privacy Policy. Ensure the acceptance mechanism is ECTA-compliant with affirmative consent, timestamped records, and the ability for the customer to download a copy. For negotiated enterprise agreements, attach the DPA as a schedule to the master services agreement.
Implement monitoring and review processes
Establish a register of all DPAs in force, with renewal and review dates. Schedule annual reviews of each processor's compliance — either through audit rights, SOC 2 reports, or ISO 27001 certifications. Monitor for changes in processors' sub-processor lists and data hosting locations. Update DPAs when processing activities change, when new regulations are published, or when the Information Regulator issues relevant guidance.
Frequently Asked Questions
A Data Processing Agreement (DPA) is a legally required contract between a data controller (called a "responsible party" under POPIA) and a data processor (called an "operator" under POPIA) that governs how personal information is processed on the controller's behalf. Under POPIA Section 21, the responsible party must ensure that the operator processes personal information only with the responsible party's knowledge and under a written contract that establishes security obligations, processing limitations, and confidentiality. The DPA is not optional — it is a statutory requirement. Without it, both parties face enforcement action by the Information Regulator, including administrative fines of up to R10 million under Section 109, enforcement notices, and civil liability to affected data subjects. Similarly, GDPR Article 28 mandates a written agreement with specific mandatory provisions for businesses processing EU personal data. A DPA protects both parties by clearly defining their respective obligations and limiting liability exposure.
What You Get With This Template
Dual POPIA-GDPR compliant — satisfying Section 21 of POPIA and Article 28 of GDPR simultaneously, with mapped terminology for both frameworks
Comprehensive security measures framework aligned with POPIA Section 19 and GDPR Article 32, with specific technical and organisational requirements
Breach notification provisions with a 72-hour timeline aligned with GDPR Article 33, satisfying POPIA Section 22's "as soon as reasonably possible" standard
Cross-border transfer safeguards addressing POPIA Section 72 and GDPR Chapter V, with provision for standard contractual clauses
Sub-processor management with both specific and general authorisation models, objection rights, and flow-down obligations
Clickwrap-ready format for SaaS platforms, with ECTA-compliant electronic acceptance mechanisms
Audit rights with practical alternatives (SOC 2, ISO 27001) and cost allocation provisions
Customisable template with clearly marked decision points for processing scope, security measures, sub-processor consent model, and breach notification timelines