Data Processing Agreement (DPA) Requirements Template

The data controller decides why and how personal data is processed. The data processor handles data on behalf of the controller. In B2B SaaS, your customer is typically the controller (they decide what employee or customer data to put in your product) and you are the processor (you store and process it according to their instructions). This distinction matters because processors have specific legal obligations including following controller instructions and maintaining sub-processor agreements. See the [Technical PM Handbook](/technical-pm-guide) for how these roles affect system architecture decisions.

Any B2B product that processes personal data on behalf of customers needs a DPA if those customers are subject to GDPR, CCPA, or similar regulations. In practice, this means almost every B2B SaaS product. Even if your product only stores email addresses and names, those are personal data. Enterprise sales teams will tell you that DPA requests have become standard in procurement workflows since 2020.

Provide at least 30 days advance notice before adding a new sub-processor. Give customers a formal objection mechanism. If a customer objects, offer alternatives (different region, different processor) or allow them to terminate without penalty. Most customers will not object if the new processor meets equivalent security standards. The key is transparency: surprise sub-processor changes erode trust.

At minimum, your product needs: data export (machine-readable), data deletion (scoped to individual data subjects), encryption (at rest and in transit), access controls, and audit logging. More mature DPA requirements include data residency options, processing restriction, automated breach detection, and deletion certification. Prioritize these using the [RICE Calculator](/tools/rice-calculator) based on how many enterprise deals they block.

Your DPA should specify a data return period (typically 30-60 days) during which the customer can export their data. After that period, you must delete all customer data and provide a deletion certificate. The tricky part is backups: most systems retain backups for 30-90 days beyond the deletion date. Your DPA needs to disclose this and commit to eventual purge. Build automated termination workflows rather than relying on manual processes. ---