{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Data Processing Agreement (Art. 28 GDPR)","description":"Controller-to-processor contract mandated by Art. 28(3) GDPR. Structured to align with the Article 28 obligations and compatible with Commission SCCs 2021/914 Module 2 for onward transfers outside the EU/EEA.","type":"object","required":["controller","processor","subject_matter","processing","security_measures","term"],"additionalProperties":false,"properties":{"agreement_reference":{"type":"string"},"effective_date":{"type":"string","format":"date"},"controller":{"$ref":"#/$defs/party"},"processor":{"$ref":"#/$defs/party"},"main_agreement_reference":{"type":"string","description":"Reference to the underlying services agreement this DPA annexes (e.g. 'Master Services Agreement dated 2024-06-01')."},"subject_matter":{"type":"string","description":"Art. 28(3) subject-matter clause — what the processor is asked to do with the data."},"duration":{"type":"string","description":"Art. 28(3) duration — usually 'term of the main agreement' plus any wind-down period."},"processing":{"type":"object","required":["nature_and_purpose","data_subjects","data_categories"],"additionalProperties":false,"properties":{"nature_and_purpose":{"type":"string"},"data_subjects":{"type":"array","items":{"type":"string"},"minItems":1},"data_categories":{"type":"array","items":{"type":"string"},"minItems":1},"special_categories":{"type":"array","items":{"type":"string"}}}},"sub_processors":{"type":"array","description":"Approved sub-processors at the time of signing. Additions require notice per Art. 28(2) + the controller's right to object.","items":{"type":"object","required":["name","service"],"additionalProperties":false,"properties":{"name":{"type":"string"},"service":{"type":"string"},"location":{"type":"string"}}}},"sub_processor_notice_period_days":{"type":"integer","minimum":7,"maximum":90,"description":"Days of advance notice for new or replacement sub-processors. 30 is the de-facto market norm; shorter is controller-unfriendly."},"security_measures":{"type":"array","minItems":1,"description":"Annex II equivalent — technical and organisational measures per Art. 32.","items":{"type":"string"}},"international_transfers":{"type":"array","items":{"type":"object","required":["country","safeguard"],"additionalProperties":false,"properties":{"country":{"type":"string"},"safeguard":{"type":"string"}}}},"breach_notification_hours":{"type":"integer","minimum":24,"maximum":72,"default":48,"description":"Hours within which the processor must notify the controller of a personal data breach. 48 is typical; anything over 72 undermines the controller's own Art. 33(1) 72h deadline."},"audit_rights":{"type":"string","description":"Scope of the controller's audit rights (direct audit, third-party auditor, frequency, cost allocation)."},"return_or_deletion":{"type":"string","enum":["return","delete","controller_choice"],"description":"Art. 28(3)(g) — at end of services, processor returns or deletes. 'controller_choice' is the default."},"term":{"type":"object","required":["governing_law","jurisdiction"],"additionalProperties":false,"properties":{"governing_law":{"type":"string"},"jurisdiction":{"type":"string"}}},"signatures":{"type":"object","additionalProperties":false,"properties":{"controller_signatory":{"type":"string"},"controller_title":{"type":"string"},"processor_signatory":{"type":"string"},"processor_title":{"type":"string"}}}},"$defs":{"party":{"type":"object","required":["name","address","contact_email"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"address":{"type":"string"},"company_number":{"type":"string"},"contact_email":{"type":"string","format":"email"},"dpo_email":{"type":"string","format":"email"}}}}}