What is included and what is not

Included

  • Data processing agreement in controller-to-processor form (processor-to-sub-processor variant on request)
  • Processing details annex (subject matter, duration, nature, purpose, data categories, data subjects)
  • Technical and organisational security measures annex, completed from your intake answers
  • Cross-border transfer mechanism for the jurisdiction (for example EU standard contractual clauses for Malta, the UK international data transfer addendum, Singapore PDPA transfer terms)
  • Sub-processor list and notification template
  • Review and sign-off by a lawyer admitted in the jurisdiction
  • One round of amendments after your internal review

Not included

  • A data protection impact assessment or transfer risk assessment (available as a separate service)
  • Privacy policies, cookie notices and consent flows
  • Registration or notification with a data protection authority where required
  • Sector rules (for example health records or financial data) beyond the general privacy statute

Review levels

Workflow draft
Product priceas listed, per jurisdiction
  • Drafted on the LegalMatrix workflow from the approved clause library and your intake answers
  • Checked by the LegalMatrix legal team for consistency and completeness
  • Delivered as an editable document with a clause-by-clause note
  • Document preparation: no lawyer sign-off, no legal advice
Lawyer review and sign-off add-on
+ US$350 and upper jurisdiction; 30% of the product price for larger documents
  • A lawyer admitted where the document will be used reviews, revises and signs off
  • Enforceability check for that jurisdiction: governing law, formalities, mandatory rules
  • Reviewer's name, admission and date on the document; 20-minute call included
  • Covered by the practising entity's professional indemnity

Counterparty Contract Review, the Negotiation Playbook and the Successor Programme Document Set include lawyer review in the price. IP filings are made by registered practitioners and are not offered without one.

Who it is for

For

  • SaaS and services companies asked by customers for a DPA
  • Companies appointing vendors that will process their customer or employee data
  • Groups moving personal data between entities in different countries

Not for

  • Controller-to-controller data sharing (ask for a data sharing agreement)
  • Companies with no personal data processing by third parties

What the document does

Clause summaries. The product delivers the drafted and reviewed document, not a template.

Roles and instructionsIdentifies controller and processor and limits processing to documented instructions.
Confidentiality and personnelBinds staff to confidentiality and restricts access to those who need it.
Security measuresRequires appropriate technical and organisational measures, described in the annex.
Sub-processorsSets the approval or notification mechanism and flows down equivalent obligations.
Data subject rights and assistanceRequires the processor to assist with access requests, impact assessments and authority enquiries.
Breach notificationFixes the notice period and content after a personal data breach.
International transfersIncorporates the transfer mechanism recognised in the jurisdiction and allocates responsibility for assessments.
Audit and recordsProvides for records of processing, audit rights and reliance on independent certifications.
Return and deletionRequires return or deletion at the end of services with certification.
Liability and precedenceAligns liability with the main agreement and states which prevails.

How it runs

  1. Intake

    A data mapping questionnaire captures the processing, locations, sub-processors and security controls. An analyst confirms the right transfer mechanism.

  2. First draft

    The LegalMatrix workflow produces the DPA and annexes with the jurisdiction's mandatory processor terms built in.

  3. Professional review

    A lawyer admitted in the jurisdiction checks the mandatory content against the privacy statute and regulator guidance, and signs off.

  4. Signature

    After your review and one round of amendments, signature-ready versions are issued with a sub-processor notice template.

  5. Record update

    GoGoTrust files the executed DPA in the company's contract register and records the sub-processor list date.

✓
Signed off by
A lawyer admitted in the jurisdiction reviews and signs off the agreement before release.

Price by jurisdiction

JurisdictionPriceWith lawyer sign-off
SingaporeUS$1,800US$2,350
Hong KongUS$1,800US$2,350
JapanUS$1,800US$2,350
TaiwanUS$1,800US$2,350
United StatesUS$1,800US$2,350
CanadaUS$1,800US$2,350
AustraliaUS$1,800US$2,350
New ZealandUS$1,800US$2,350
United KingdomUS$1,800US$2,350
MaltaUS$1,800US$2,350

Questions

Which privacy law does the DPA follow?

The statute of the jurisdiction you select: for example the PDPA in Singapore, the PDPO in Hong Kong, the APPI in Japan, the CCPA and state laws in the United States, PIPEDA and provincial laws in Canada, the Privacy Act in Australia and New Zealand, the UK GDPR, the EU GDPR for Malta and the PDPA in Taiwan.

Do we need standard contractual clauses?

If personal data leaves the UK or the EU, usually yes; the product includes the UK addendum or EU clauses for those jurisdictions. Other jurisdictions have their own transfer conditions, which the DPA addresses.

Can the DPA cover several customers?

Yes. It is drafted as a template you can attach to your MSA or online terms; the processing annex is completed per customer.

Our customer sent their own DPA. Can you review it?

That is a review service quoted separately; the product is the preparation of your own DPA.

Does it include a transfer risk assessment?

No. The product includes the contractual mechanism; the assessment is a separate service.

Related products