Contract creator

Select a contract template

Choose a template to get started. Ready to customize and send. Free forever, no credit card required.

Data Processing Agreement

DPA

Define how personal data is processed, secured, and shared between controllers and processors.

Artificial Intelligence Addendum

AI Addendum

Set terms for AI use, training data, model outputs, and related risk allocation.

HIPAA Business Associate Agreement

HIPAA BAA

PHI terms for a covered entity or a downstream subcontractor.

References

Statutes, model forms, and commentary cited for each agreement type below.

Privacy

Data Processing Agreement (DPA): A data processing agreement (processor contract) sets controller and processor roles for personal data: subject matter, duration, nature and purpose of processing, data types, data-subject categories, security measures, sub-processor rules, audit rights, and return or deletion at end of processing. Under GDPR Article 28, processing by a processor must be governed by a binding written contract with these elements.
Sources: GDPR.eu: What is a data processing agreement?; ICO: Contracts between controllers and processors; EDPB: Guidelines 07/2020 on controller and processor
Artificial Intelligence Addendum (AI Addendum): An AI addendum allocates rights and risks for artificial intelligence and machine-learning features: permitted model use, customer data for training or fine-tuning, ownership of prompts and outputs, confidentiality, human oversight, transparency to users, and security. Useful when products involve generative AI or high-risk AI systems covered by frameworks such as the EU AI Act and NIST AI RMF.
Sources: EU AI Act: Article 13 (transparency to deployers); NIST: AI Risk Management Framework
HIPAA Business Associate Agreement (HIPAA BAA): A HIPAA business associate agreement limits use of protected health information, requires safeguards and breach notice, and covers both covered-entity and subcontractor relationships. It is not a GDPR data processing agreement.
Sources: eCFR: 45 CFR 164.504

Attribution

Formable contract templates include language modified from Common Paper standard terms. The originals are free to use under Creative Commons Attribution 4.0 (CC BY 4.0). View the Common Paper standards and CC BY 4.0 license.

The partnership agreement follows the Uniform Partnership Act (1997) from the Uniform Law Commission. See the Uniform Partnership Act (1997).

The HIPAA business associate agreement follows the sample contract provisions published by the U.S. Department of Health and Human Services. Read the HHS sample provisions.

The data processing agreement is built around Article 28 of the GDPR, as published by the European Commission. Read Regulation (EU) 2016/679.