How to Use the Bonterms DPA v.2
Use the Bonterms Data Protection Addendum v.2 (DPA) to address data protection obligations when a Provider processes personal data on a Customer's behalf under a Main Agreement (such as the Bonterms Cloud Terms or another SaaS or services agreement).
Steps:
- Review the DPA with your lawyer.
- Choose your version. All three versions have identical substantive terms and differ only in how you enter into them:
- Attachment Version — complete the DPA Details at the end of the DPA and incorporate the completed DPA into your Main Agreement. Best when you want to sign only one agreement concurrently with the Main Agreement or an amendment.
- Signable Version — complete the DPA Details at the end of the DPA and sign the DPA itself. Best when you want a standalone, signed DPA in a single document.
- Cover Page Version — create a Cover Page that incorporates the DPA by reference, and sign the Cover Page. Best when you want your own format or branding or expect extensive Additional Terms (see example Cover Page).
- Complete the DPA Details. In the Attachment and Signable Versions these appear at the end of the DPA; in the Cover Page Version the same information appears on your Cover Page.
- Key Terms — identify the parties and specify the Main Agreement, DPA Effective Date, Subprocessor List, and (if the EU SCCs apply) the Designated EU Governing Law and Designated EU Member State.
- Processing Details — confirm each party's Role (Customer defaults to Controller), the categories of data subjects and personal data, whether any sensitive or special-category data is in scope, and the Security Measures. Make sure each checkbox is accurate for your deal or adjust accordingly.
- Additional Terms — propose any additions to, or modifications of, the DPA, including its Exhibits. See examples in the Playbook of Additional Terms.
- Send your DPA (or Cover Page) with completed DPA Details to your counterparty.
- Negotiate any changes.
- Execute, based on the version you chose:
- Signable Version — sign the DPA.
- Cover Page Version — sign the Cover Page.
-
Attachment Version — the DPA is not signed on its own. It becomes effective when you incorporate it (including the completed DPA Details) into your Main Agreement either by language in the Main Agreement itself or in an amendment, addendum or other written agreement that the parties then sign.
FAQs:
What is the Bonterms DPA?
A free, balanced Data Protection Addendum (sometimes also called a "data processing addendum") for use when a Provider processes personal data on a Customer's behalf (Provider as processor, Customer as controller or processor). It is built to satisfy the GDPR Article 28 processor requirements and to handle cross-border transfers, and it also addresses UK GDPR, the Swiss FADP and the CCPA with expandability to other U.S. state privacy laws. It works with any underlying agreement (the "Main Agreement") under which SaaS or another service ("Service") is being provided from Provider to Customer.
Which version should I use?
All three versions of the DPA contain identical substantive terms — Sections 1 through 10, Exhibit A and Exhibit B. They differ only in how the parties enter into the DPA:
- Attachment Version — you complete the DPA Details (Key Terms, Processing Details and any Additional Terms) at the end of the DPA and incorporate the completed DPA into the Main Agreement (either by reference from the Main Agreement or through an amendment, addendum or other written agreement). Best when you are entering into the DPA concurrently with the Main Agreement or an amendment and only want to sign one agreement.
- Signable Version — you complete the DPA Details (Key Terms, Processing Details and any Additional Terms) at the end of the DPA and sign the DPA itself. Best when you want a standalone, signed DPA in a single document.
- Cover Page Version — you complete the Key Terms, Processing Details and any Additional Terms on a Cover Page that incorporates the DPA by reference, and sign the Cover Page. Best when you want to customize a Cover Page using your own format or branding or expect extensive Additional Terms.
What changes across the three versions?
All three versions of the DPA are substantively identical but differ as necessary to reflect their different execution methods:
- Introductory paragraph. Each version explains how the parties enter into that version of the DPA.
- Section 1 (Definitions). The Attachment and Signable Versions define "DPA Details" as the place the parties specify the Key Terms, Processing Details and any Additional Terms. The Cover Page Version defines "Cover Page" for the same information. Those changes flow through to other definitions.
- Section 2.5 (Relationship to Main Agreement). The Attachment and Signable Versions incorporate the DPA together with the DPA Details into the Main Agreement. The Cover Page Version incorporates the DPA together with the Cover Page.
- Signatures. The parties sign the Signable Version itself or the Cover Page for the Cover Page Version. The Attachment Version is not signed but becomes effective when the parties sign the Main Agreement or an amendment to the Main Agreement with proper incorporation language.
Is the Bonterms DPA legally effective for my needs?
That's for you and your counsel to determine. The DPA is a self-service standard: review it — and the way you plan to enter into it — with your own counsel, and use Additional Terms to change anything that doesn't fit your needs. In particular, consider whether your method of entering into the DPA satisfies any execution requirements that apply to you, including for the EU SCCs (the DPA uses a deemed signature approach). If you use the Attachment Version, note that you must separately effectively incorporate it into the Main Agreement by separate written agreement or language in the Main Agreement itself.
Can I use the DPA with a non-Bonterms agreement?
Yes. The DPA is drafted against a generic "Main Agreement," so it is designed to work with any underlying contract.
How does the DPA handle cross-border transfers?
Exhibit A builds in the EU Standard Contractual Clauses, the UK Addendum and the Swiss amendments — there's nothing separate to assemble or sign. If Provider is certified under the Data Privacy Framework, Exhibit A recognizes that certification as a basis for EEA, UK and Swiss transfers to the U.S. so long as that certification remains valid and available as a transfer basis.
What is the DPA not designed to cover?
The DPA covers Provider's handling of personal data on Customer's behalf. It is not designed to cover personal data Provider collects for its own purposes (such as account registration data) or transfers between two controllers.
What if Customer is not the controller of the data?
The DPA works either way — it applies to Customer as a controller or as a processor, and Exhibit A applies the matching Standard Contractual Clauses automatically. Just update the "Role" row in the Processing Details, which defaults to controller.
What about sensitive or special-category data?
The Processing Details include a check-the-box entry. If sensitive or special categories of personal data are in scope, you specify the categories and any additional restrictions on processing; otherwise check "None/Not Applicable."
How do I change the standard terms?
Add Additional Terms rather than redlining. The Playbook of Additional Terms for the DPA gives common, ready-to-use examples. Additional Terms can change any part of the DPA, including the Exhibits (see below).
Can we change the Exhibits?
Yes. Additional Terms may modify or even replace Exhibit A (Cross-Border Transfer Mechanisms) or Exhibit B (Region-Specific Terms) — the DPA's definitions of "Additional Terms" and "Exhibit" provide for this expressly. State clearly which Exhibit and which provisions you are changing. One caution: where the Standard Contractual Clauses apply, they have their own legal requirements, and it is up to the parties to ensure any changes remain consistent with them. The Playbook of Additional Terms includes examples.
Is the DPA free?
Yes — free to use under CC BY 4.0. It is a self-service form and is not legal advice; have counsel review before use.
How is this different from Version 1.0?
Three main things, plus a new format choice: (1) it works with any "Main Agreement", whereas v1 was tied to the Bonterms Cloud Terms; (2) it replaces the Setup Page and Schedules with a single DPA Details section; and (3) it builds Exhibit A (Cross-Border Transfer Mechanisms) and Exhibit B (Region-Specific Terms) into the DPA itself, so you no longer assemble them yourself. It also comes in three execution versions: Attachment, Signable and Cover Page.
Can I still use Version 1.0?
Yes. Existing v1 DPAs stay in effect, and v1 remains available under Prior Versions. Use the current DPA for new agreements when you're ready.
How to use DPA V.1
Note: A new version of the DPA was released on July 17, 2026. Below are the instructions to implement the DPA v1.
Use the Bonterms Data Processing Addendum (DPA) V.1 to address data protection obligations in connection with your Cloud Terms or related cloud services agreement.
Steps:
- Review the DPA with your lawyer or legal counsel (see example)
-
Prepare your DPA Setup Page (see example)
- Identify the parties and complete the Key Terms: Agreement, DPA Effective Date and Subprocessor List
- Propose any Additional Terms (additions to, or modifications of the DPA)
- Prepare your Schedules (see examples)
- Send your DPA Setup Page and Schedules to your Counterparty
- Negotiate the DPA Setup Page and Schedules
- Sign the DPA Setup Page and create your DPA
-
Incorporate the DPA into your Cloud Terms by either:
- Adding the DPA as an Attachment to an Agreement created using the Cloud Terms and referencing it under Attachments on your Cloud Terms Cover Page (if executing concurrently); or
- Amending an existing Agreement to add the DPA as an Attachment.
FAQs for the DPA v1
What data transfers is the DPA generally designed to cover?
- The DPA is generally designed to cover a U.S.-based Provider (processor) interacting with a U.S. or global Customer (controller or processor) uploading personal data from U.S. or E.U. data subjects as part of its Customer Data under the Cloud Service.
How is the DPA structured between the main body and Schedules?
- The main body of the DPA is designed to generally cover E.U./U.K. GDPR, Swiss and common U.S. state law data privacy principles. Cross-border transfers and U.S. state and other jurisdiction-specific issues may be addressed by the parties on Schedule 3 (Cross-Border Transfer Mechanisms) or Schedule 4 (Region-Specific Terms).
Why are the DPA Schedules provided as "examples"?
- Because the Schedules must be customized to reflect the particulars of the transaction, and given the flux in the regulations themselves, we provide Schedules to the DPA under the Resources tab as “examples” in Word. You are free to create your own Schedules or start from the Bonterms examples and modify as you see fit.
What data transfers is the DPA not designed to cover?
- The DPA is not designed to cover Provider’s use of personal data in its capacity as a controller (such as registration data) nor controller-controller transfers.
Can I use the DPA without using the Cloud Terms?
- The Bonterms DPA is an Attachment to the Cloud Terms. This means it uses terms defined in the Cloud Terms (such as Affiliate, Agreement, Cloud Service, Customer Data, Order and Subscription Term) and relies on the larger contractual structure of the Cloud Terms (see, for example, the introduction to and Section 2.4 of the DPA and Sections 1, 5.3, 14.4, 16.5 and 22.10 of the Cloud Terms).
- Using the Bonterms DPA with a different underlying agreement would require a legal analysis of the differences with that agreement and, if a decision is made to proceed, drafting of any necessary corresponding provisions through a DPA Setup Page or other addendum.
Will the DPA work for my particular circumstances?
- To understand if the DPA will work in any particular circumstance you should consult with a U.S. or global privacy lawyer, as applicable.
Video walkthrough of How to Use the Bonterms DPA:
Updated