Any supplier that handles personal data for you needs a written agreement, and that includes the AI services it uses. This form records what is processed, where, by whom and under what safeguards, with the processor's declaration built in.
This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Form number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary content. Simple and usable form templates
developed over 25 years through practical use in the real world.
Further guidance on data processing and suppliers:
Download this form template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This form is also included in the GDPR / Data Protection Toolkit and the ISO 22458 toolkit and the integrated toolkits that include it, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help putting data processing agreements in place with your suppliers, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Data Transfer and Processing Agreement Template
A data transfer and processing agreement for putting a written contract in place with any organisation that processes personal data on your behalf. It records the processor's details and locations, the term of the agreement and its review date, the security measures in place, a summary of the personal data processed, any sub-processors, and a signed declaration from the processor.
What's Included in this Agreement
- General details - the requirement for a written contract and the terms that apply
- Data processor details - company name, all processing locations, the date the agreement is effective from, review date, term, and the technical and organisational security measures
- Summary of personal data transferred / processed - personal data and categories of data subject, processing and purpose, and duration held
- Sub-processors - each sub-processor, the service provided including any use of AI, and the processing location and transfer safeguard
- Processor declaration - commitments on lawful processing, security, sub-processors, breach notification and that personal data is not used to train an AI provider's models, signed and dated
Who Needs a Data Transfer and Processing Agreement?
Any organisation that uses a supplier to process personal data on its behalf - payroll, IT support, cloud software, marketing platforms, recruitment systems or AI services.
Included in the GDPR / Data Protection Toolkit
This form is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 22458 toolkit.
Works with the Personal Data Register
Each processor and AI service provider should appear in the sharing and transfer details of your personal data register, such as the F-IMS24 Personal Data Register, so the register and the agreements tell the same story.
Using the Agreement
Complete one agreement for each processor. Enter the processor details and security measures, summarise the personal data processed and who it is about, list any sub-processors, and have the processor sign the declaration. Set the review date and keep the signed agreement with your supplier records.
AI Service Providers as Sub-processors
Many suppliers now build AI features into their services, using an AI provider behind the scenes. Those providers are sub-processors, so the agreement asks for each one to be named with the service provided, where the processing takes place and the transfer safeguard, and it includes a declaration that personal data is not used to train an AI provider's models.
Why a Written Agreement Matters
A written agreement sets out what the processor may and may not do with the personal data, and is one of the first things asked for when a supplier is reviewed or a breach occurs at a supplier.
Related Documents
Other documents in the GDPR / Data Protection Toolkit that work alongside this one:
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation