Templates and records · ISO 27701 · Clause A.1 y A.2

ISO 27701 data processing agreement template

Every supplier that processes data on the company’s behalf needs a contract whose minimum content is set by law. The privacy system checks that it exists and is honoured.

In one sentence

The data processing agreement sets out the subject matter, duration, nature and purpose of the processing, the types of data and data subjects and the processor’s obligations —documented instructions, confidentiality, security, sub-processors, help with rights and breaches, return or deletion at the end and audits—, because GDPR article 28(3) requires it; ISO/IEC 27701 covers these agreements in tables A.1 and A.2, from both the controller’s and the processor’s side.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause A.1 y A.2 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Mandatory document A document that must be kept in force (GDPR art. 28(3); tables A.1 and A.2)
Who fills it in: Purchasing or the contracting department, with the officer The PIMS manager checks that no processor handles data without a contract
When: Before the supplier receives any data It is reviewed on renewal, when the service changes or on notice of new sub-processors
How long it is kept: For the duration of the service and beyond Set by the organisation according to the limitation periods for potential liability

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

The standard asks the controller to choose processors that provide sufficient guarantees and to have a contract with them covering the necessary controls. Of the processor it asks that data be processed only on the customer’s instructions, that the customer be told if an instruction seems unlawful, and that sub-processors be kept under control.

Article 28(3) lists the minimum content of the contract. Article 28(2) prohibits engaging another processor without prior specific or general written authorisation; under a general authorisation, the processor must give notice of changes so the controller can object.

The contract is not filed and forgotten: the controller must be able to check that it is being honoured, and the contract must allow for audits or inspections (art. 28(3)(h)).

Read it in context: Controls for controllers and processors, in the ISO 27701 Academy

Structure

Fields the template should include

Subject matter, duration, nature and purpose of the processing
Types of personal data and categories of data subjects
Processing only on documented instructions
Confidentiality of the processor’s staff
Security measures under GDPR art. 32
Sub-processor arrangements and authorisation
Help with rights, breaches and impact assessments
Return or deletion of data at the end
Information and audits made available to the controller
International transfers, if any

Example

Example: a fictitious company’s payroll bureau

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Contract	PR-2026-03 · Northbank Engineering Ltd (controller) and Pennine Payroll Services (processor), both fictitious
Subject matter	Payroll preparation and handling of social security registrations and terminations · Annual term, renewable
Data and data subjects	Identification, bank and pay data of 86 employees
Sub-processors	General authorisation; 30 days’ notice to object · Current: payroll software provider with servers in the EU
Breaches	Controller informed within 24 hours of the bureau becoming aware
End of contract	Return in a standard format and certified deletion within 30 days
Review	Annual security questionnaire · Latest: February 2026, no findings

At the audit

Mistakes auditors commonly flag

Suppliers with access to data and no contract, because they “only provide support”.
Generic contracts that do not describe the data or the data subjects.
Nobody knows who the cloud provider’s sub-processors are.
The contract provides for audits, but the processor is never reviewed.

In Kimobox

How this record is kept in Kimobox

1Processors are managed from the supplier portal with their contract and expiry date.
2The system sends an alert before a contract or a review expires.
3The record of processing activities links each recipient to its contract.
4Periodic reviews are documented as supplier evaluations.

Frequently asked questions

What people ask us before getting started

Is accepting the supplier’s terms enough?

It may be, if they cover everything in article 28(3) and are in writing. You need to read them: many leave out the sub-processor arrangements or the final deletion.

What does an ISO 27701-certified processor bring?

Evidence that its privacy system has been audited, which makes it easier to demonstrate sufficient guarantees. It does not replace the contract or the controller’s own review.

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025