Intermediate

Data processing agreements

Nathan-Ross Adams

7 Sections

Collapse All

M1 | Understanding data processing agreements

M2 | Core components of a DPA

M3 | Drafting practicalities and templates

M4 | Negotiation strategies and contested issues

M5 | Managing and monitoring DPAs

M6 | Cross‑border transfers and emerging trends

M7 | Capstone project and certification pathways

We’ve created this course to take participants from the fundamentals of data processing agreements (DPAs) to advanced drafting and negotiation skills. Each module builds on the previous one and reflects the regulatory imperatives and practical challenges highlighted in contemporary research on DPA training programmes. Modules may be delivered via lectures, interactive workshops and practical exercises depending on the depth of the topic.

Free

Last Updated: February 20, 2026

This course includes

Purpose and legal basis: The course opens by explaining why DPAs are essential instruments for assigning responsibilities between controllers and processors. It notes that laws like POPIA and the GDPR make such agreements mandatory and that failing to implement a compliant DPA can expose organisations to significant liability

Understanding roles and triggers: Early modules clarify the distinction between controllers, processors and sub‑processors. They discuss when a DPA is required and how to recognise the need for data‑processing clauses in broader contracts. The difference between a full DPA and a data‑processing addendum is also addressed.

Core clauses and obligations: Participants learn the mandatory elements that must appear in a DPA, such as the scope of processing, security measures, sub‑processing approvals, breach notification and assistance with data‑subject rights. There is emphasis on tailoring these provisions to meet the expectations of POPIA, the GDPR, UK GDPR, US state laws and other regional frameworks.

Drafting and templates: The course provides practical guidance on drafting DPAs. It covers how to adapt model clauses and industry templates to fit specific jurisdictions and industries, how to integrate DPAs with master service agreements and when to use a stand‑alone agreement versus a short addendum.

Negotiation strategies: A dedicated module explores the “contested issues” that often delay DPA execution—liability caps, indemnity, audit rights, sub‑processor approvals and data‑transfer clauses—and offers risk‑based negotiation tactics for balancing commercial interests with compliance obligation.

Operational management: Beyond drafting, the course teaches how to operationalise DPAs, from maintaining inventories of processing activities to monitoring compliance and managing sub‑processors. Participants learn how to align incident‑response plans with contractual obligations and when to amend or terminate an agreement.

Cross‑border and emerging topics: Advanced modules examine international data‑transfer mechanisms, the impact of new laws in APAC and Latin America, and the integration of AI governance into DPAs. The trend toward standardised agreements, such as national DPAs and interoperability frameworks, is also highlighted.

Capstone and certification: The course concludes with a capstone project where participants draft and negotiate a DPA for a hypothetical outsourcing arrangement. It also outlines how DPA expertise aligns with professional certifications and how ongoing CLE sessions can build advanced negotiation skills.

Data processing agreements

M1 | Understanding data processing agreements

M2 | Core components of a DPA

M3 | Drafting practicalities and templates

M4 | Negotiation strategies and contested issues

M5 | Managing and monitoring DPAs

M6 | Cross‑border transfers and emerging trends

M7 | Capstone project and certification pathways

Deleting Course Review

Course Access

Related Courses

ROPA Mastery: Designing, operating & defending records of processing activities

Designing a data protection programme