Internal

Processor agreement

who does what, agreed in advance

When someone handles data for you, an agreement says what they may do with it. Your web agency is often the first one concerned.

What matters

List who touches your dataHosting, maintenance, forms, newsletter, advertising, statistics. Often it is the same agency.
Ask for their standard textMany agencies and hosts already have one. Read it before you write your own.
Ask who else is involvedYour agency also uses a host or a mail tool. Ask for that list.
Agree what happens if data leaksDecide who warns whom if data leaks, and how fast.
Keep a signed copyFile it with your record of processing.

Which country asks for what

Each row leads to the rules of that country.

Country	Contract	What it asks
Alabama	In some cases	From 1 May 2027, the contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return and proof of compliance.
Argentina	Required	The contract must say that the provider acts only on instructions, must set security levels and confidentiality, and must extend the security duties to the provider.
Australia	In some cases	If the web agency or provider is abroad, the business must take reasonable steps, and is generally expected to sign an enforceable contract requiring it to follow the privacy principles.
Austria	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Belgium	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Brazil	In some cases	The law names no contract, but the authority calls one good practice, covering subject, duration, nature and purpose, data types, and each party's duties.
Bulgaria	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Canada (federal)	In some cases	The business must use a contract or other means to keep protection comparable while the web agency or provider handles the data; the authority treats a contract as the main means.
Canada: Alberta	In some cases	The law does not require a written contract, but the business is responsible for the web agency or provider's compliance with the law for the services it engages.
Canada: British Columbia	In some cases	The law does not require a written contract, but the business stays responsible for data it controls, even when the web agency or provider holds it.
Canada: Manitoba	In some cases	The business must use a contract or other means to keep protection comparable while the web agency or provider handles the data; the authority treats a contract as the main means.
Canada: New Brunswick	In some cases	The business must use a contract or other means to keep protection comparable while the web agency or provider handles the data; the authority treats a contract as the main means.
Canada: Newfoundland and Labrador	In some cases	The business must use a contract or other means to keep protection comparable while the web agency or provider handles the data; the authority treats a contract as the main means.
Canada: Nova Scotia	In some cases	The business must use a contract or other means to keep protection comparable while the web agency or provider handles the data; the authority treats a contract as the main means.
Canada: Ontario	In some cases	The business must use a contract or other means to keep protection comparable while the web agency or provider handles the data; the authority treats a contract as the main means.
Canada: Quebec	Required	The written contract must set the measures that keep the data confidential, limit its use to the assignment, and stop the provider keeping it after the end.
Chile	Required	From 1 December 2026, the contract must set the assignment, its duration, the purpose, the data types, the categories of people concerned, and each party's rights and duties.
China	Required	The business must agree with the web agency or provider the purpose, duration, method, types of data, safeguards and each side's rights and duties, and must supervise the work.
Colombia	Required	The contract must set the scope, the provider's activities, its duties to the business and the people concerned, respect for the business's data policy, security and confidentiality.
Colorado	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, the security measures, deletion or return, proof of compliance and audits.
Connecticut	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.
Croatia	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Cyprus	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Czech Republic	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Delaware	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments. From 1 January 2027 it must also name each specific purpose.
Denmark	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Egypt	Required	The web agency or provider must act on written instructions and keep a copy of the processing contract with the business in its records.
Estonia	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
European Union	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Finland	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Florida	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.
France	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Germany	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Greece	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Hungary	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Iceland	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
India	In some cases	From 13 May 2027, the business may use a web agency or provider only under a valid contract, which must include suitable security safeguards.
Iowa	Required	The contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return and proof of compliance.
Ireland	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Israel	Required	If the web agency or provider gets access to a database, the agreement must state the data and uses allowed, systems, duration, return or destruction, security, confidentiality, subcontracting and yearly reporting.
Italy	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Japan	Required	The law requires the business to supervise the web agency or provider; the official guidelines count a contract as part of that supervision, with the security of the data as its focus.
Kenya	Required	A written contract must set the processing details, instructions, confidentiality, security, deletion or return of the data, and audits.
Latvia	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Liechtenstein	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Lithuania	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Luxembourg	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Malaysia	Required	The business must use the contract to require the web agency or provider to report a data breach promptly and to give all reasonable help.
Malta	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Maryland	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, security practices, deletion or return, proof of compliance and assessments.
Mexico	Required	Contract clauses or another legal document must prove the relationship, its scope and its content, and must match the privacy notice.
Minnesota	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments or inspections.
Montana	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.
Nebraska	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.
Netherlands	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
New Jersey	Required	The binding contract must set the instructions, the data, the duration, deletion or return of the data, and checks by the business.
New Zealand	No rule found	The law requires no specific contract, but the business must do everything reasonably within its power to prevent misuse of data given to a web agency or provider.
Nigeria	Required	A written agreement must make the web agency or provider follow the law, help with people's rights, secure the data, give compliance information and report any new provider.
Norway	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Oklahoma	In some cases	From 1 January 2027, the binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.
Oregon	Required	The binding contract must set the instructions and require confidentiality, deletion or return of the data, and checks by the business.
Philippines	Required	A contract must set the subject, duration, purpose, type of data and location, and bind the web agency or provider to documented instructions, confidentiality, security, deletion or return, and audits.
Poland	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Portugal	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Romania	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Russia	Required	The contract must list the data, the operations and the purposes, and require confidentiality, security, proof of compliance on request and warning of leaks; the visitor must also consent to the handover unless a federal law says otherwise.
Saudi Arabia	Required	The agreement must state the purpose, types of data, duration, breach reporting, any foreign law that applies to the web agency or provider, and its subcontractors.
Singapore	In some cases	A written contract is what limits the duties of the web agency or provider; it should make clear the scope of work done for the business.
Slovakia	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Slovenia	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
South Africa	Required	A written contract must ensure that the web agency or provider sets up and maintains the security measures the law requires.
South Korea	Required	The business must sign a document that bans use outside the mission and sets the purpose and scope, safeguards, limits on subcontracting, supervision and liability.
Spain	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Spain: Catalonia	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Sweden	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
Switzerland	Required	A contract is needed, but the law sets no written form; the web agency or provider may only do what the business could do itself, and the business must check that the data stays secure.
Texas	Required	The contract must set clear instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.
Thailand	Required	The business must make an agreement that controls the work of the web agency or provider so that it meets its duties under the law.
Turkey	In some cases	If data goes abroad without another safeguard, a standard contract is notified to the authority within 5 working days; otherwise the authority recommends a written contract limiting the web agency or provider to the instructions of the business.
Ukraine	Required	A written contract must set the purpose and scope, and the web agency or provider may use the data only within them.
United Arab Emirates	Required	The contract with the web agency or provider should set the scope, subject, purpose, nature, type of data and categories of people; if several providers work together, a written contract must set their roles.
United Kingdom	Required	A written contract, which may be electronic, sets out the work, its length and the data, and binds the web agency or provider on instructions, confidentiality, security, other providers, breaches, deleting or returning data, and audits.
United States: California	Required	The written contract must ban selling or sharing the data, name each specific purpose, require the same privacy protection, and let the business check and stop misuse.
United States: states without a comprehensive privacy law	In some cases	No general rule applies, but Washington requires a binding contract for consumer health data, Massachusetts a contract with security duties for its residents' sensitive data, and the children's rule assurances from providers.
Vermont	In some cases	From 1 January 2028, the binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.
Vietnam	Required	The web agency or provider may receive personal data only after an agreement or contract, which must state each side's duties, rights and responsibilities.
Virginia	Required	The binding contract must set the instructions, the nature and purpose of the work, the data, the duration, each party's rights and duties, confidentiality, deletion or return, proof of compliance and assessments.

You are the agency?

For agenciesWhat to do when it is not your site Hosting and CDNWhere your clients’ data lives

Start from a first draft

Gather these facts and copy our prompt into your AI tool. The prompt tells it to use only your facts and to end with a list of points to check.

Both companies
The work
The data
Countries
Their providers
Leaks
End of contract

A draft from an AI is not legal advice. Read it again with your lawyer or legal adviser before you use it.

See the prompt

You help me prepare a first draft of a processor agreement between my company and a provider.

My facts:
- My company: [legal name, address]
- The provider: [legal name, address, what they do for me]
- Data they handle: [customers, visitors, staff]
- Why they handle it: [hosting, maintenance, newsletter, statistics]
- Countries where the data is stored: [list]
- Their own providers: [list]
- Who warns whom if there is a data breach, and how fast: [what we agreed]
- What happens to the data when the contract ends: [what we agreed]

Rules for you:
- Use only the facts I give you. Do not invent a company name, a tool, a country, a duration or a legal basis.
- If a fact is missing, write [TO COMPLETE] and list it at the end.
- Write in plain words, in short sentences.
- End with a list called "Points to check", with everything a lawyer should read again.

Your other documents

See them side by side

PublicPrivacy policySays what you do with people’s data, and what their rights are.PublicCookie policyLists your cookies. Cookie Rocks writes it for you.InternalRecord of processingYour inventory of what you do with personal data.Kept on your siteProof of consentShows what each visitor chose, and when.

30 days free

Try the complete plugin. Nothing breaks on day 31.

no card, no catch

Every feature, every update and support, for 30 days. Setting it up takes a few minutes; the month gives you time to get the purchase through your accounting.

During the trial: everything, including the full settings and the scans
After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
What waits for a key: most settings, updates and support

How the trial works, in detail

Get your trial key

Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.