DPA Agreement Template for Denmark

The Data Processing Agreement (DPA) is required whenever an organization (the data controller) engages another party (the data processor) to process personal data on its behalf under Danish jurisdiction. This mandatory agreement, required by Article 28 of the GDPR and the Danish Data Protection Act, establishes the framework for compliant data processing activities. The DPA Agreement must detail the scope of processing, security measures, confidentiality obligations, and procedures for data breaches. It should address specific Danish legal requirements and incorporate guidance from the Datatilsynet. The document is essential for ensuring legal compliance, protecting data subjects' rights, and clearly defining the responsibilities of both parties in the data processing relationship.

1. Parties: Identification of the data controller and data processor, including full legal names, registration numbers, and addresses

2. Background: Context of the agreement, relationship between parties, and purpose of the data processing arrangement

3. Definitions: Key terms used in the agreement, including those from GDPR and Danish law

4. Scope and Purpose: Details of the processing activities, categories of data subjects, and types of personal data

5. Duration: Term of the agreement, including start date and conditions for termination

6. Data Processor Obligations: Core obligations of the processor including processing only on documented instructions

7. Sub-processors: Conditions for engaging sub-processors and obtaining controller authorization

8. Technical and Organizational Measures: Security measures required to ensure appropriate level of data protection

9. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests

10. Personal Data Breaches: Notification requirements and procedures for handling data breaches

11. Audit Rights: Controller's rights to audit and processor's obligations to contribute to audits

12. Data Return and Deletion: Obligations regarding data handling upon agreement termination

13. Liability and Indemnification: Allocation of responsibility and liability between parties

14. Governing Law and Jurisdiction: Specification of Danish law application and jurisdiction