Philippine Data Processing Agreement Generator

Step 1 of 8

Confirm the real privacy roles

7 questions on this step

A processor acts for the controller on documented instructions. If either party chooses its own purpose or essential means, separate controller terms may be required.

This is an outsourcing relationship involving personal data—not merely confidentiality, controller-to-controller sharing, an employee notice, or data-subject consent

Actual processing relationship

Controller (PIC) instructs processor (PIP)Processor for some activities; independent or joint controller for othersBoth parties independently decide purposes or essential meansThis is controller-to-controller sharing. Use the Data Sharing Agreement instead; this processor DPA cannot be generated for it.Roles are not yet verifiedThe document is marked as a draft that must not be signed until the roles are verified.

Actual service and why personal data is needed

Purposes and essential means decided by the controller

Operations performed only under documented controller instructions

Sector and affected population

Every activity was mapped to its real PIC, PIP, joint-controller, or independent-controller role

Step 1 of 8

1. PARTIES, PURPOSE, AND STATUS

This Data Processing Agreement (“DPA”) is made on October 2, 2026 between [CONTROLLER LEGAL NAME], a corporation with address at [CONTROLLER ADDRESS] (the “Controller” or “PIC”), and [PROCESSOR LEGAL NAME], a corporation with address at [PROCESSOR ADDRESS] (the “Processor” or “PIP”).

It supplements [MAIN AGREEMENT]. Service: [UNDERLYING SERVICE]. It takes effect on October 16, 2026 and applies: [PROCESSING TERM].

Current route: Heightened, sensitive-data, or cross-border route. Actual relationship selected: personal information controller to personal information processor. Controller decisions: [CONTROLLER PURPOSES AND ESSENTIAL MEANS]. Processor instructions: [PROCESSOR OPERATIONS].

Precedence: This DPA controls for personal-data protection conflicts; the main services agreement otherwise controls the commercial service. This DPA does not itself create consent or another lawful basis, change the parties' actual roles, register a DPO or system, satisfy a PIA, notify a data subject or regulator, or prove operational compliance.