--- title: "DPA Drafting. GDPR Article 28 + SCCs | GTC" description: "Attorney-drafted Data Processing Agreements. GDPR Article 28 terms, a security schedule, and SCCs or the UK IDTA for cross-border transfers. Flat fee up front." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "name": "Global Trademark Company LLC", "url": "https://globaltrademarkcompany.com", "logo": "https://globaltrademarkcompany.com/gtc-logo.svg", "description": "Multi-practice IP and business legal firm. Trademarks in 100+ jurisdictions, patents in 10 + PCT, copyrights under Berne. Operating since 2016.", "foundingDate": "2016", "sameAs": [ "https://www.linkedin.com/company/globaltrademarkcompany/", "https://www.trustpilot.com/review/globaltrademark.co" ], "contactPoint": [ { "@type": "ContactPoint", "telephone": "+1-510-973-4964", "contactType": "customer service", "areaServed": "US", "availableLanguage": [ "English" ] }, { "@type": "ContactPoint", "telephone": "+44-7453-347853", "contactType": "customer service", "areaServed": "GB", "availableLanguage": [ "English" ] }, { "@type": "ContactPoint", "telephone": "+91-6397-329955", "contactType": "customer service", "areaServed": "IN", "availableLanguage": [ "English", "Hindi" ] } ], "address": [ { "@type": "PostalAddress", "streetAddress": "712 H Street NE, Suite 2094", "addressLocality": "Washington", "addressRegion": "DC", "postalCode": "20002", "addressCountry": "US" }, { "@type": "PostalAddress", "streetAddress": "YSC Complex, 4th floor, A-400, 12 Ajit Singh House, Sri Aurobindo Marg", "addressLocality": "New Delhi", "addressRegion": "Delhi", "postalCode": "110016", "addressCountry": "IN" } ] }, { "@context": "https://schema.org", "@type": "Service", "name": "DPA Drafting", "serviceType": "Data Processing Agreement Drafting", "description": "Attorney-drafted Data Processing Agreements. GDPR Article 28 terms, a security schedule, and SCCs or the UK IDTA for cross-border transfers. Flat fee up front.", "provider": { "@type": "LegalService", "name": "Global Trademark Company", "url": "https://globaltrademarkcompany.com" }, "offers": { "@type": "Offer", "price": "495", "priceCurrency": "USD", "description": "A flat fee per DPA, quoted in writing up front after a free scoping call. Cross-border transfer addenda (SCCs, UK IDTA) priced as a defined add-on." } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://globaltrademarkcompany.com/" }, { "@type": "ListItem", "position": 2, "name": "Data Privacy & Technology", "item": "https://globaltrademarkcompany.com/services/data-privacy-technology" }, { "@type": "ListItem", "position": 3, "name": "DPA Drafting", "item": "https://globaltrademarkcompany.com/services/dpa-drafting" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "When do I need a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Whenever a controller. The party deciding the purposes of processing. Engages a processor that handles personal data on its behalf. A SaaS provider serving EU customers needs DPA templates for its customers; a vendor that touches personal data needs DPAs with the businesses it serves. GDPR Article 28 requires the arrangement to be in writing." } }, { "@type": "Question", "name": "What are SCCs and when do I need them?", "acceptedAnswer": { "@type": "Answer", "text": "Standard Contractual Clauses are the EU Commission's pre-approved data-transfer terms that provide a lawful basis for moving personal data from the EEA to countries without an adequacy decision, including the US and India. The 2021 SCCs are the current version. You need them whenever your DPA covers a cross-border transfer out of the EEA." } }, { "@type": "Question", "name": "What is the UK IDTA?", "acceptedAnswer": { "@type": "Answer", "text": "After Brexit, the UK introduced its own International Data Transfer Addendum to attach to the EU SCCs, with a standalone UK version also available. If your processing involves UK personal data being transferred internationally, the DPA needs either the IDTA or the UK addendum to the SCCs." } }, { "@type": "Question", "name": "Can I just use a template I found online?", "acceptedAnswer": { "@type": "Answer", "text": "GDPR Article 28 sets out specific required clauses, and most online templates miss one or two, often the security schedule or the sub-processor mechanism. EU regulators have been active on enforcement, with fines reaching €20M or 4% of global turnover. An attorney-drafted DPA is drafted to your role and reusable across relationships, which a generic template is not." } }, { "@type": "Question", "name": "Do you negotiate against the counterparty's draft?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. If a customer or vendor sends their own DPA, we review it against GDPR Article 28, flag the terms that work against you, typically the audit rights, liability, and security schedule, and negotiate a version you can sign. That is quoted as a defined scope, separate from drafting a fresh DPA." } }, { "@type": "Question", "name": "What will it cost?", "acceptedAnswer": { "@type": "Answer", "text": "A flat fee per DPA, confirmed in writing on a free scoping call once your role and the transfer routes are known. Cross-border transfer addenda. SCCs or the UK IDTA. Are a defined add-on. There is no hourly billing and no quote after the fact." } } ], "dateModified": "2026-06-15" } ] --- [](/) - Trademarks - Patents - Copyrights - Data Privacy - Business Legal - [Pricing](/pricing) - Resources Sign inEN · USD Sign in 1. [Home](/) 2. [Data Privacy & Technology](/services/data-privacy-technology) 3. DPA drafting Data privacy · GDPR Article 28 + SCCs # Draft a DPA that holds up A Data Processing Agreement records how a controller and processor handle personal data, and GDPR Article 28 sets out the terms it must contain. We draft the DPA to your role, append Standard Contractual Clauses or the UK IDTA where data leaves the EEA or UK, and match a security schedule to how you operate. $495 Flat fee, quoted up front after a free scoping call [Draft Your DPA](/forms/catalog/data-privacy-technology/data-processing-agreement?ref=b2c) [Excellent Trustpilot ](https://www.trustpilot.com/review/globaltrademark.co) ![Privacy and data-protection professionals reviewing a data processing agreement in a bright modern office](/img/home/hero-library/m-duo-bright-review-480.jpg) DPA drafted Controller ↔ processor Transfer clauses SCCs included Vendor-ready Signed & tracked Legal team GTC's privacy team Data-protection counsel Legal team GTC's privacy team Data-protection counsel 10,856+ clients 11 attorneys 5 offices 10,856+ clients 11 attorneys 5 offices 10+ years IIPLA Top IP Consultancy 2026 [Upwork · Top Rated Plus ](https://www.upwork.com/freelancers/zamanzaidi) Trusted by founders and brands worldwide ![Atlys](/assets/atlys-B5BookJo.webp "Atlys")![Perfora](/assets/perfora-D4_346Y2.webp "Perfora")![Soxco](/assets/soxco-D31kWMAz.webp "Soxco")![BossCare](data:image/webp;base64,UklGRr4PAABXRUJQVlA4WAoAAAAQAAAAZwEAMQAAQUxQSGcNAAABGTNt26h3Xf58p4GI6H/mRiEPMGGZtu2VJDkrb1ferpGXxsh777333ntvuKD/DeLee++9HSMvrZeXVt57V3m+zKyVcho+aBqdqEEVR3Zooq1INA1rUUWyps0yilW8aAZ9UUIVh6lgCWUcpIYlpEymhj1yJwqp4pObZm8kmoqDdmCxjGRNZ1BGsoY96ETC/tg0LFaRclOwFykj0RRsdqLQNG12opAqDpKXilUkG7q+ItE27EUnUqwiYgIm4HaRiT+qO3guz+ypPYUn8QQez+N4TI/iZ/y473cP3+TrfYvv9POwq5m6a0/k8f2CH/OT3J/1c0xT/iJWj+bRPZau030MP+T7/LCftuuIGHhsT+uFnCP6URP39iPGfsJP8f0Q2nKeVPMprT+54Et8te8S7jJiPKE7a3oUQph05HW7Np6Mx+G3+1alXUSInt8VznKJxYy9K55PduETfCO5S8heP5dTMpFiVmt5706c77WyzLt+oubLe3ZFF6kmAGi+ltv7fCtjMhMgAJyx6ZPnCRnpZf3EjjaXv8YP+jWOao21LjOIqsPbLmdgVHth+0KkmYD+tepzzf9qRjwIvDt6GjNlKaFp/pt9hxGZedHiC6ibAFNaAFa19YUqJxPZkZJm6PIg0mRyKiIvgum6aSJr8hnkx2IiMGx96q7czEvfcksIgCDMxAwQSIDABQemARGBlN3oOSos1Ee2JTEzJ0FEZMTMDCKCldd+PZBCRKRata5NYVCqm5DMKdP59afDYQgFiaey9D2+ViHjsofKAcAEYRdUHfY921mzEjHBXRk5qJDYGp9sNh5X5NUcT5l+Yawamt9t9UA9ifLo0potByj/B+zcxTY1Tkw2nFCpPV9hW8S7g6WlMtzQZB1ZQPxt7m7eTxXIrgEgAMiV6yMyQyIyoMqzmA8AgjGzDIqmXp4P7Vav2dREAAh84EtZNQAgomiusjk5ZwOKCGBmieBCn+nzrPiQIpOv5hnNKSTk5cMX2OllT86shdsyupvPt2VA2p6beXonrLhecjnKOS3LvJfL72kq5NSwG1KXkFiBOSNSLU8hlAlmDg6HMGQC/ANXT1iKO2UdukGpe77ZngJQeOTqeocG5O7g5CgtLBQZSV7xGm677eusTPhG1HgeBKgE9lJHUjaaLwKA8kr1RLR5jqy3sBEiIREp5GY2K2NfadpNjclKw5gYmVG3pRCaA6zsOgQJMl7Yvzt2lJnzrDhoH4tP7KvkFcu9X8xsEQBEQ6MHm0HgSiQ79+JQ+gwf68vthAaoLTKMnQdOjufjUA6QZldKAKQ6p0fn6oUQwpR9Vg8sX3WxhVimAJIVCTBlRiRNKTGwu44iwJQIweH9U50OAAbAkO7wytbMbKN4v1NnNQbWKtneFFKqPay9mDf0+zccGjGwHIh2TtZiGLICA7T2fJ7DxmqIpLWF/m1De1d23BQwIJIps+/+Agyk/on2NkAwLF1k1Y8Iou7KdLffaV/tKQwkZ249QuqXXsk3uOzDXS0TgYT0ZIuNAAaoMfPceqaJlOrfual0av8wJ8UKYBHOjEQrz6btw5AJ/nQJyXL1qtVqr4/E3B7pjwNMKWGi3JW3Xrm2JROQGDSS1VdcM4wUM6nG+RojByb8pEILguwi024+EIIEHtlC8nJ1TzEiAwTzYbMMQkoJQGvfC3pONy4nYCahpFX/GgepJoAqJ72RPVsJtG1FxABHNX+LjajWCiwCQGbsZ0RkKRG4q/NnUwApGaL+/onRrE6GaUDC3rVv6IN8lQRpJGa173mdYSOmJBKu/U7r+JFfAICGDj6TTdsEmIO9x2Ds3XarRwyt9daXmc6MKFQiwaHSZCqSlXvuYub0AGn6plQWhZFNENTXv5RJpJtB9k2zdQGScSGUgGp1IyNVWaxPDbsAbV45GUkFKNOULGAfvX/NB6SUfPnejEjpEKL+TsEZBDtHlmYIQHDsyPC2M2strF8ZgckAsDlVTAYm9FpPwpAJwQX2TI2ZqnbpzePaAJh7PuYfFgGqLIaAQvIqIiT07CgjipQvFLZ9nT6Ew/VyLSy0F+orR4q9a7yJ7LUnagqC0lMyNSRLMTjkQK3PVYLYiMzSmfligYmpN16ZbJFB7Sb171sAyh2kWXZbmZBqcSzEPmMwhsen+9703TlzIyXfXlOl7uKrexN5EauyPhWmgAnx/c5wUKzrg84Lmp0PjTD8WTZmuwRw++rjmzdPdimRLudKRQmA0kW2lRFFHAqBBwffxb9LqxQBSpsSINafb2FWxM6e+PdqCsgc2bPgwjTZIn19dowFqhdzLctTxHJqb9SstWCoOiooMCRUmhCpTAjESIIGhVzeORVEoNZSbqukIu2DTrVrysiazHaRNBO2/mrvHeSppQCoXh6iDGe9xWCQ8kbmXTaC5Zh1E4OQORPiUGkxBTkY4Js6n817rcXcVMnSkSkPRjHDWDfGveSIwzP7Yay7UsgZHffAEgSbJs60RXQOdRPE6VKRyoRMF54SIUUmD4bW0jUH+7a/ndMFkxTATiOnBKiV08mhcF3xHEbkoCQ09zJmxlwQAFnfKIUQkoEEg9IUdb1MCAX2SET39FicPm89m4/YROpJa0pBvBpMGkVdPxbhXMVBirWNgsTW8lxXmSCQUkQCbEpmALrEKiMyfTGr0ppvp41O/N6QLPpIJ4NTEB5zO0Y6kqEIIfXK4lDy3f17bzQKFYEsrxsJxGM+TEnsFnwzI2KTtEjrbG66mK5adkkHSDcjhWbbt4zAhMEZhQzw/G1jJgCSFDVOjhsVzuyPIwKT9ObyGRHM0BM62L9qGMRixGJ09EUURmTaUioLJhmFpopoUMgCPHD7yJ578W0pAQy9iEVKFLYPXaAQaQVE5Y6VEdEj3sOtzciACRsf6CPNS4izyj6wXDp0jBNEmzMuxOPAd/3cmpU2hBAM61EOosF83VNyABExWLLSRCDZdso2EBbqAQMMM7abNSQ2g2qMAjJpWnw5D39ZNQMA21/ok/z9sSSQ23vzUPHT3VjgAd2ehnhhuOqW4rUH5nXaCGyEEueUSPX0vXmRKQkgzQSYrJQiVSh5FZsgSjZCNjLtKERm7Yz+zzvLi/gbN36qB+xvizizR4MiGrPh5UfqgHd7KAlwYWp6x/KU1l6tshSlCyQifWWJhMWNI2OeBgApWVm1qFrXERM1chAngCFIJDMstN7C+2iKwBw78gU+2GlfMg8ge+kvNwOJ7n1HD63Mx+j24qqAWdpz2Vaj0cq1YFUWrbSJB0FekVHkjByqEgGQEspzGnpqK2SOcjYlwcyKDJTmEJk2vaR394imFgDClcv2xCPD1QK8Xr8ndxgAtR54Pe5ldRs5GYu02wESRoumi3QrMBvxsYm5TWXkzK7JhYliQYLs3tzmuCy4G8e3kUqGYgEpOeNaehGv61U5QhzGrn/q0JEiuv2GVfWRsPt8sssHDscRTAEZ63IMEPRoxeV0kYIUuZfD6+eIjGpnZ5vxmYVSgW2n0ax0Sm6r/aBpTgXAZEAEiYw7qryd38oLJQx2lutwS3UYMlmL++J/XzAlBK1+wyluR+VmJdhC+gkMgYlT/UXLiKLG0Hi/ZmuShXpxC2gNla35w34KGDBSBUSZF6z/eW+jOik2JcMN2YiA1qW164Zj2ALR+GYDVS5PDrXlIBDnwryf70cGAHUqD+znLIRB4EoAdnZUXX5KJsXSr9s2GFAYq3d7GRgd/Je/+AOVTCqZdKdYrTt5AVDjbMXh9rKPwV84vf/fjpIRlNaaCImZ0Dm5TqcOjyUDc+r4cBQpAuBaD2xlYFDld/Fe1ihthHDEw4judAVgzVTK0jf5PoAP7Z65vyOQJAFq/IHN0unlpHh49wHWCmBYtbzKxKBufh2v4kqVLox9kbiJ0rHqTJ+MSGnCfSb783cRXDGUIoCJ8mfpumJScBeqvskDWjYhM7fu7G28ufHIojRIM1w5lI/gnzkwvq9llHLiBCTGJAYUbjy8eVNHpYhg+pYtOTl2fT9kBkDI2K2jt7ygm/e10lBaeUCQ1QDvva4z26Q0KTADIAgzMyUht85cHfzrpZQa8PD0oW4fqWSAkel7L+rhfzzbtaOUhIXi1MZeRQBQP7AcrTWdSCysLtfWtRGFMgIAllqETIlk/eXjq5sHO5ZnU1LsLuxsbBAusfYfOHny1udTUSkwdx55dyrbQuJw9w2FyRc0IySHL7D7HPftGqkxvzvALdRIwA7DpMC88buXdxavOdFNauwC1+klCyC+hAJC/49ewdG+1pEGqQFSStMMiu2F2CIYT/37VNQ40ZVaKwKb0twaGSnVFpsmMQPKKhW88QEje618xEwMkD3W6SYH+MenfafcWXMUKaUAltKUobu1EXcBgHHJVWeXeo25ocmObuXIBIf17eJG1apMagjLrTM37K/1ezXHloWx4rK5VsGe/6/niFkyrFZl3QbAq5cdUwRNLCF956xOBRBuHfn3U7GXr9m5nA79Qn17ZNssX5/DJeFo8+w5xq1aXvmA78eloktI2lw4cMDs5Vqehh+XthUBxy5Q9whSgqjlIOHyyhQDpFiC3ZyFFIdbE8PbOmfbtkfS9N2g5BIGPwBWUDggMAIAAFATAJ0BKmgBMgA+YS6TRqQnqqEmVVrRUAwJaW4w+BYAP5ggr4D25Yh6SxovmDgsYK9LSPmMryNyCPwNBcY7Jc3QHm7mS756VFN7XcJrP4qwJpbxc16RFuBQwx3KiaTUQMkAvmpKQDUaXXWs84mDQF9xqWcwsp/OAoOE6D71hPedTYf0nqUOad68fBYTFjSNQsi/FVts7Hnn3H1phwxXSGv3sQAA/vxc0AAD2ytUopQYMka0KCDlzBRxEmGTEDDi6Jybf7RA043SVsQQgDmSdJf/6BNI2F538tmlTBE6ecqDT+KGbXsVpT8IQZYKqsepkc+ZOLkcdakc3r6iT/0cPX23uqoCit2Na46P5FC5IeHcy4AAF6n4EQ9Z0NV/EcqmsebKzb/mIUv5iNFBlstIAeoGx3SMKK7uOlmZWyBghV3JBxJie2Kpy8YKWmKCaUQSpdnL8Nz8Y9Zm3sugq3dvyWCV79Y6Rum9d4si1XhC3vWzfd15CaeSitaDnGiPSd0TZ5Y0RVjLToAAAV9O69XyTQYXchLMRXQmU2F5Q0WqmZC+xcpdzW37WzAAExWO7c7LV0aQoKhZd4X/LT/6qSSWmO7BH0+V9Q1088r8kecUJeOgkq16L+Y4Ro9IHR2yF2L19bAAAJ1ugpQysANOq7vmK+t8JfEQPqcpg4iGLHHqhtrCJH/8V1v7QMyYkeFWe6r46Cp0Uyz9rBhYR5LjIz6rVnv/z/W9i5DiMEsd0QhQgAAA "BossCare")![Innovist](/assets/innovist-BgYdG_yd.webp "Innovist")![Bacardi](/assets/bacardi-JU27gvk6.webp "Bacardi")![Footcare Lab](/assets/footcarelab-BLfB0WJu.webp "Footcare Lab")![Bare Anatomy](/assets/bare-anatomy-CBhgu9Ro.webp "Bare Anatomy")![Freedom](/assets/freedom-confectionery-HioHiGYc.webp "Freedom") How it works ## How DPA drafting works with GTC 1 ### Scoping call A 30-minute call confirms whether you are the controller or the processor, what personal data and processing activities are involved, where the data subjects sit, and where the data flows go. We confirm GDPR scope and quote a flat fee. 2 ### Drafting The DPA is drafted to your role. Controller-processor or processor-sub-processor. SCCs and the UK IDTA are appended where transfers leave the EEA or UK, and the technical and organisational measures schedule is matched to your security posture. 3 ### Negotiation + execution One round of counterparty revisions is included. Most pushback lands on the audit rights and the security schedule. We tune those defaults to what is enforceable in your industry, then prepare the DPA for signature. What it costs ## A flat fee per DPA DPA Drafting is $495. Each DPA is drafted for a flat fee, confirmed in writing on a free scoping call once your role and your transfer routes are known. There is no hourly billing and no quote after the fact. One round of counterparty negotiation is included. Cross-border transfer addenda. The 2021 SCCs or the UK IDTA. Are a defined add-on, and negotiating against a counterparty's own draft is quoted as a separate scope. What's included - Controller-processor or processor-sub-processor DPA drafted to your role - GDPR Article 28(3) required terms: subject matter, duration, nature and purpose, type of personal data, and categories of data subjects - Security measures schedule (technical and organisational measures) matched to your posture - Sub-processor approval and notification mechanism - 2021 Standard Contractual Clauses for transfers out of the EEA, where applicable - UK International Data Transfer Addendum (IDTA) for UK transfers, where applicable - Audit and inspection rights drafted to what is enforceable in your industry - Data breach notification cascade from processor to controller - Return or deletion of personal data at the end of the contract - One round of counterparty revisions DPA template (controller-processor or processor-sub-processor) Flat fee, quoted up front SCCs addendum for cross-border transfers Defined add-on UK IDTA addendum for UK transfers Defined add-on Negotiating against a counterparty's own DPA Quoted by scope The exact flat fee is confirmed on the scoping call before any drafting begins. A DPA is a contract, not a one-off compliance check. We keep it current as you add sub-processors or open new transfer routes. Get started ### Draft your DPA Tell us about the data processing and a GTC attorney will scope the DPA and email a flat-fee quote after a free scoping call. No payment required Reply within 1 business day A GTC attorney reviews it & sends a flat-fee quote. Crossing a border? Note whether the data leaves the EEA or involves UK personal data. That tells us whether the SCCs, the UK IDTA, or both need to be appended. Brand details 1 Project / Matter Name\* Short label (e.g. 'ACME-Beta DPA'). 2 Your Role\* Drives the negotiation posture. 3 Other Party\* Name + brief description of the counterparty. 4 Description of Processing\* What data is being processed, for what purposes, on what types of data subjects. Approximate scale. 5 Existing DPA Draft (upload, optional) If the other side sent a draft, upload it. Your contact details Already have an account? B2B clients: sign in for contracted pricing. [Log in](/login) Or continue as guest First name \* Last name \* Email \* Phone 🇺🇸 +1 Create an account to track your order I agree to the [terms & conditions](/terms), [privacy policy](/privacy), and updates \* Submit request No payment required. Your details stay confidential. Why GTC ## Why draft your DPA with GTC Legal team GTC's privacy team Data-protection counsel Attorney-led ### Drafted to your role Controller-processor or processor-sub-processor. The obligations differ. We confirm which side you are on before drafting, so the DPA carries the right Article 28 terms for your position in the chain. ### Built for cross-border transfers Where personal data leaves the EEA, we append the 2021 Standard Contractual Clauses; for UK data, the UK International Data Transfer Addendum. The transfer mechanism is part of the DPA, not an afterthought. ### A security schedule that fits The technical and organisational measures schedule is matched to how you run, not copied from a generic list. That is the schedule a counterparty's security team reviews most closely. ### Reusable across relationships One well-drafted DPA template carries across your customer and vendor relationships, with a sub-processor mechanism and a breach-notification cascade already built in. Your Customer Success Team ## A dedicated team that owns your matter from start to finish. Every GTC client gets a dedicated Account Manager and a Senior Account Manager who learn your business and stay with you from first email to final filing. They are named people who pick up the phone and already know your matter, so every step moves forward without delay. ### Your Account Manager Your day-to-day point of contact, who coordinates every matter, keeps things moving, and already knows your file. They have your full history, so you start every conversation where the last one left off. ### Your Senior Account Manager Senior oversight on strategy and escalations, stepping in as your needs grow, so every important detail stays on track. A named person, on email or a call, at every step. ![Your dedicated GTC Customer Success Team](/assets/m-onboarding-bright-welcome-C-heDolY.jpg) How we compare ## GTC vs. a generic template or a big consultancy What you get GTC Online filing services Doing it yourself All GDPR Article 28(3) required terms present and drafted to your role Security schedule (TOMs) matched to your operations, not a generic list SCCs and the UK IDTA appended where transfers leave the EEA or UK Sub-processor approval and breach-notification cascade built in One round of counterparty negotiation included Drafted by attorneys, reusable across customer and vendor relationships All GDPR Article 28(3) required terms present and drafted to your role GTC Online filing services Doing it yourself Security schedule (TOMs) matched to your operations, not a generic list GTC Online filing services Doing it yourself SCCs and the UK IDTA appended where transfers leave the EEA or UK GTC Online filing services Doing it yourself Sub-processor approval and breach-notification cascade built in GTC Online filing services Doing it yourself One round of counterparty negotiation included GTC Online filing services Doing it yourself Drafted by attorneys, reusable across customer and vendor relationships GTC Online filing services Doing it yourself Timeline ## A signable DPA inside a week Most DPAs are drafted and ready for the counterparty within five to seven business days of the scoping call. 1. Day 1 ### Scoping call A 30-minute call confirms whether you are controller or processor, what data and processing are involved, and where the data flows go. We confirm GDPR scope and quote. 2. Days 2–5 ### Drafting The DPA is drafted to your role, with SCCs and the UK IDTA appended where transfers leave the EEA or UK, and a security schedule matched to your posture. 3. Days 5–7 ### Negotiation + execution One round of counterparty revisions is included. We tune the audit-rights and security-schedule pushback to what is enforceable in your industry. 4. Ongoing ### Kept current As you add sub-processors or open new transfer routes, the DPA and its schedules are updated so the contract keeps pace with how you process data. In their words ## All your legal, in one place. One accountable team across every practice, operating since 2016. [Excellent Trustpilot ](https://www.trustpilot.com/review/globaltrademark.co) 10,856+ Clients served 11 In-house attorneys 5 Global offices 10+ Years since 2016 DPA drafting FAQs ## Frequently asked questions When do I need a DPA? Whenever a controller. The party deciding the purposes of processing. Engages a processor that handles personal data on its behalf. A SaaS provider serving EU customers needs DPA templates for its customers; a vendor that touches personal data needs DPAs with the businesses it serves. GDPR Article 28 requires the arrangement to be in writing. What are SCCs and when do I need them? What is the UK IDTA? Can I just use a template I found online? Do you negotiate against the counterparty's draft? What will it cost? [Draft Your DPA](/forms/catalog/data-privacy-technology/data-processing-agreement?ref=b2c) Your wider data-contract stack ## The rest of your privacy posture A DPA is one document in a wider privacy and contracting posture. These commonly travel with it. [ ### Privacy policy & terms The public privacy notice and website terms that line up with your DPA commitments. View privacy policy & terms ](/services/privacy-policy-terms)[ ### GDPR compliance The wider programme your DPA sits inside. Consent, records of processing, and transfer mechanics. See GDPR compliance ](/services/gdpr-compliance)[ ### Data, privacy & technology The full hub. Privacy programmes, AI governance, and breach response under one roof. Explore the hub ](/services/data-privacy-technology) Ready to draft your DPA? ## Ready when you are. Tell us about the data processing and your role in it. We will confirm GDPR scope, quote a flat fee up front after a free scoping call, and have a signable DPA ready for the counterparty within a week. [Book My Free 30-Min Consult](/free-consultation)[Or Send Us a Message](/contact) ![GTC counsel on a client consultation call](/assets/m-client-call-bright-iWHveXAG.jpg) ## Site footer ![Global Trademark Company](/assets/gtc-logo-white-DQ8YcvVd.svg) Secure Every Step of Your Growth Trusted by brands since 2016 [hello@globaltrademarkcompany.com ](mailto:hello@globaltrademarkcompany.com) [](https://www.linkedin.com/company/globaltrademarkcompany/) [+1 510-973-4964 (US & International) ](tel:+15109734964)[+44 7453 347853 (UK & EU) ](tel:+447453347853)[+91 6397-329955 (India) ](tel:+916397329955) ### Company - [About us](/about) - [Contact](/contact) - [Our lawyers](/lawyers) - [Case studies](/case-studies) - [Careers](/careers) - [Press](/press) - [B2B partners](/b2b-partners) - [GTC Advantage](/gtc-advantage) ### Services - [All services →](/services) - [US trademark](/services/us-trademark) - [Madrid Protocol](/services/madrid-protocol-filing) - [Patent filing](/services/patent-filing) - [Copyright registration](/services/copyright-registration) - [Commercial contracts](/services/nda-drafting) - [Fractional GC](/services/fractional-gc) - [Data privacy](/services/gdpr-compliance) ### Resources - [Blog](/blog) - [Trademark Glossary](/resources/glossary) - [Country Guides](/resources/country-guides) - [Specimen Guide](/resources/specimen-guide) - [Class Assist](/class-assist) - [Free TM Check](/free-trademark-check) - [Free Consultation](/free-consultation) - [Reviews on Trustpilot](https://www.trustpilot.com/review/globaltrademark.co) ### Get Started - [Login](/login) - [Sign up](/signup) - [Application status](/application-status) - [Terms of service](/terms) - [Privacy policy](/privacy) - [Refund & credit policy](/refund-policy) - [Sitemap](/sitemap) ### Our Offices United States 712 H Street NE, Suite 2094 Washington DC 20002 India 4th Floor, A-400, 12 Ajit Singh House Sri Aurobindo Marg, New Delhi 110016 European Union Iskar 75 Str., office 2 Sofia, Bulgaria China 2nd floor No. 51 Zhongshan Yi Road Guangzhou, China United Kingdom Unit 1A, 1 Bridge Road Camberley, Surrey GU15 2QR We accept: ![Visa](/assets/visa-logo-DngOCJX3.webp) ![Apple Pay](data:image/webp;base64,UklGRm4EAABXRUJQVlA4WAoAAAAQAAAATwAATwAAQUxQSBUEAAAB8EXbtmnbtrXl2trgsm3btm3bnly2bdu2bdvGxrLNgVpKSQ+dYc62+RQRE6D/iaeirMQiNShVmWVNKtQz54orV+CKc/aoSErqGv5+UInx/ohuJY3/AB4V6Tw4nnQrAxZUYtgAN2sjclCdmQ3vxqhQ447viSoJvggqNiqH6vkffVSM54pxpxnPDS1GG+e74Wv0EfWaDYvRw/l4Lq1APeet4045+ZRTTjnl3Ef+wkaDiAjWly4mU5u5WIXqz3gTPqpFNjJvdWgzInuNcZk6x5p0kkkm6FDSGdio5U4MZF5Y4rr4pY9wIHOJtNPgN99/8dQGSt2v4OBmZg6EmdULM29DhF216rwrnv3px2cvOe1cu/+daDCMDMGm0h5YGHUtACLq0c6gbxMlSWP1Skoa+3G83hAGw/t5Spo/Y3x++1nn3PUlxlcPPvQKQPDFQw++Q7Ri7K/OsigLqSyLUhM+02goGZx/TqjJfuePfcZTShr/4L94o1vT/kJgjJTOwlpwPhlPSZKSpKSOx3GaMj4YS9P9xUZKvfPMUhbaEVaV7sOC/nk1yad4C8bVKtS41EZkGgyhP+cBLpdW5nppyff6+h6ZXOk5zpNGYs5LpTbEaTFziMomOnVKM8PJBK9MJZ3FKfMu8Tp5kCOlM/lkYs01QOZo6UastX2b6tDJzSxx1vEnHr3pWIUW78McwLhKOhG2VPk8xjKa5geitROaKrUxg1GvUN2kRT7GnS/uOO2QoTsuJJ0Et0lHwQdjaSeMVo27VTSR1PU0Xi+NOdUUU0wx/dLn/onz6/CxlSSprPllRi3lnCvd1wbn8/GVGilpmieIOtr+98++/OKnwD3YXJpuyCkX3r+vdBL9DNWYb7O2ZvuTaAlnPZVNqNAU3+B1hpEBz+G81am5vyGMS2sGeEK64LcJtR9G68Y9KpoptSVOnSEMuDtg3CPtyl/9g2xXk+lfSFvcofKZthCsrQ4pFUWSknpeazSUTF3n5UIzfoxzbiprMkdqmhW1kBHtcD6YSB0dSVJRdupIDIzLpBFYvSCWlibbfKe5tdSYOoXsvNmhTh1Npq3GXT1S5ywLTKBCW1gEZC6WhpDr4Xw4j5KSDrtXOoEcwXIqut7C24Px4s77PW98ee525/dHAM5rhx1yP96A4Ldrhu5w5Et8dMhBz+IYR0jLQ7QJCyACwIP2mlNrQa0ba0pnk2m7WbbAs1lQ3828KSKbZSPMHJw7Sk3xFdG+UTv4ffuVx0o6GaMqfhpHhXb3iMr4a+QOBz6BU7EWVWI2aMH/e8a/PVY1gx8TVeK8dxm5SjKXLDroXh3ug4vqUCybV2M2DlHSIZmgEoN8iJIKzXfB259+XoGfvnXR/ColFVLH+BNV4AQdUqHaolRFloUap2rU/8YBAFZQOCAyAAAAEAQAnQEqUABQAD5RKJJGo6KhoSFIAHAKCWkAAAnxo0aNGjRo0aNGfgAA/vz4QAAAAAA=) Stripe Payoneer Wire [Trustpilot](https://www.trustpilot.com/review/globaltrademark.co) © 2026 Global Trademark Company LLC. All rights reserved. [Legal Notice](/terms)[Privacy Policy](/privacy)[Cookie Policy](/cookies)[Refund Policy](/refund-policy)Cookie Settings Hi! How can we help you today? Cookies help us improve the site. We use cookies to improve your experience, analyze site traffic, and personalize content. [Learn more](/cookies) Manage Manage Preferences RejectAccept