Subprocessor Agreement Template for United States

Create a bespoke document in minutes, or upload and review your own.

4.6 / 5

4.8 / 5

Let's create your Subprocessor Agreement

1. Select your governing law and document type:

2. Enter your key requirements:

3. Create your document to edit, review or download

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

Subprocessor Agreement

"I need a Subprocessor Agreement for our cloud storage provider who will be processing healthcare data on behalf of our medical software company, ensuring HIPAA compliance and including specific security requirements for handling sensitive patient information."

Document background

The Subprocessor Agreement is essential when a data processor needs to engage additional parties to fulfill its data processing obligations. This document is particularly relevant in the United States where various federal and state privacy laws require formal documentation of data processing relationships. The agreement typically includes detailed provisions on security measures, confidentiality, breach notification, audit rights, and compliance with applicable privacy laws. It's crucial for maintaining accountability and transparency in data processing chains, especially in regulated industries or when handling sensitive personal information.

Suggested Sections

1. Parties: Identification of the processor and subprocessor

2. Background: Context of the agreement and relationship between parties

3. Definitions: Key terms used throughout the agreement including definitions from relevant privacy laws

4. Scope of Processing: Details of what data will be processed and for what purposes

5. Security Measures: Required technical and organizational security measures

6. Confidentiality: Confidentiality obligations regarding processed data

7. Breach Notification: Procedures for handling and reporting data breaches

8. Audit Rights: Rights and procedures for conducting audits of the subprocessor

9. Data Subject Rights: Obligations to assist with data subject requests

10. Term and Termination: Duration of agreement and termination conditions

Optional Sections

1. International Transfer Mechanisms: Requirements for international data transfers, including Standard Contractual Clauses when applicable

2. Special Categories of Data: Additional requirements for processing sensitive personal data

3. Sub-subprocessing: Requirements and procedures for engaging additional subprocessors

4. Insurance Requirements: Specific insurance obligations for data processing activities

Suggested Schedules

1. Schedule A - Processing Details: Detailed description of processing activities, including data categories and purposes

2. Schedule B - Security Measures: Detailed technical and organizational security measures

3. Schedule C - Approved Sub-subprocessors: List of pre-approved sub-subprocessors if applicable

4. Schedule D - Data Transfer Mechanisms: Details of international transfer mechanisms if applicable

5. Schedule E - Compliance Requirements: Specific compliance requirements under applicable privacy laws

Authors

Alex Denne

Head of Growth (Open Source Law) @ Genie AI | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

alex.den.21@genieai.co

Relevant legal definitions

Agreement
Applicable Data Protection Laws
Business Day
Confidential Information
Data Controller
Data Processor
Data Protection Requirements
Data Subject
Personal Data
Personal Data Breach
Processing
Processing Instructions
Security Measures
Services
Subprocessor
Sub-subprocessor
Term
Transfer Mechanism

Clauses

Relevant Industries

Technology
Healthcare
Financial Services
Professional Services
E-commerce

Relevant Teams

Legal
Privacy
Information Security
Procurement
Compliance
IT

Relevant Roles

Chief Privacy Officer
Data Protection Officer
Privacy Counsel
Information Security Manager
Procurement Manager
Compliance Officer

Industries

GLBA: Gramm-Leach-Bliley Act - Federal legislation governing the protection of financial data and privacy obligations for financial institutions

HIPAA: Health Insurance Portability and Accountability Act - Federal legislation governing the protection of medical and healthcare data

FTC Act: Federal Trade Commission Act - Federal legislation providing general consumer protection requirements and enforcement authority

COPPA: Children's Online Privacy Protection Act - Federal legislation governing the collection and processing of children's personal data

CCPA/CPRA: California Consumer Privacy Act/California Privacy Rights Act - State legislation providing comprehensive privacy rights to California residents

VCDPA: Virginia Consumer Data Protection Act - State legislation establishing privacy rights for Virginia residents

CPA: Colorado Privacy Act - State legislation providing privacy protections for Colorado residents

CTDPA: Connecticut Data Privacy Act - State legislation establishing privacy rights for Connecticut residents

UCPA: Utah Consumer Privacy Act - State legislation providing privacy protections for Utah residents

GDPR Compliance: General Data Protection Regulation considerations when EU data subjects are involved in data processing activities

SCCs: Standard Contractual Clauses - Legal mechanism for international data transfers, particularly relevant for EU data

Data Processing Obligations: Contractual requirements defining the scope, purpose, and limitations of data processing activities

Security Measures: Technical and organizational measures required to ensure appropriate data protection and security

Confidentiality Requirements: Obligations regarding data confidentiality and personnel access restrictions

Audit Rights: Provisions allowing for auditing and inspection of data processing activities and compliance

Breach Notification: Requirements and timeframes for reporting data breaches and security incidents

Liability and Indemnification: allocation of responsibility and risk between parties for data processing activities

Sub-subprocessor Requirements: Conditions and obligations for engaging additional downstream data processors

Data Subject Rights: Procedures for handling data subject requests and ensuring compliance with privacy rights

Data Retention and Deletion: Requirements for maintaining and destroying data in accordance with legal obligations and contractual terms

Find the exact document you need

Subprocessor Agreement

A U.S.-compliant legal agreement governing the relationship between a data processor and subprocessor for personal data processing activities.

How Genie AI reduced drafting time by 75% for a legal firm

Let's create your Subprocessor Agreement

Authors

Alex Denne

Find the exact document you need

Subprocessor Agreement

Controller Processor Contract

Dpa Contract

Dpa Addendum

Data Controller Dpa

Joint Data Controller Agreement

Data Processing Addendum Dpa

Third Party Processor Agreement

Personal Data Collection Agreement

International Data Protection Agreement

Data Sharing Agreement Controller To Processor

Processor To Processor Dpa

Master Data Protection Agreement

Controller To Controller Data Processing Agreement

Intra Group Data Transfer Agreement

Data Management Agreement

Data Controller To Data Controller Agreement

Commissioned Data Processing Agreement

Intercompany Data Processing Agreement

Controller To Controller Dpa

Intercompany Data Sharing Agreement

Dpa Agreement

Data Transfer Addendum

Supplier Data Processing Agreement

Personal Data Transfer Agreement

Controller Processor Agreement

Order Processing Agreement

Data Protection Agreement For Employees

Affiliate Addendum

Data Privacy Addendum

Sub Processing Agreement

International Data Transfer Agreement

Data Protection Addendum

Download our whitepaper on the future of AI in Legal

Genie’s Security Promise

Your documents are private:

Your documents are protected:

Organizational security

Innovation in privacy:

Want to know more?

Draft quality legal agreements or review documents in 3 minutes

Templates

Commercial

Employment

IP

Administration

Finance

R&D

Industries

Legal Services

Manufacturing

Construction

Solutions

Use Cases

Company Types

Comparisons

Business Categories

Teams

Information