🇿🇦 South Africa · DPA Generator
A complete Data Processing Agreement Word document tailored to a named AI vendor + service: 12 main DPA clauses + Schedule 1 Particulars of Processing (Art. 28(3) mandatory schedule) + Schedule 2 Technical and Organisational Measures (12 control domains × measure × implementation × evidence) + Schedule 3 Sub-Processors (pre-populated with typical sub-processors for the named vendor, with explicit verify-against-vendor callout) + Schedule 4 International Transfer Mechanism + Annex A AI-Specific Contract Terms (6 AI clauses covering training-data restrictions, IP ownership, automated decision-making transparency, bias and fairness, AI error liability, model-update notification + exit rights) + Annex B Negotiation Checklist (10 items with vendor positions, your counter-positions, red flags, and fallback positions) + Annex C Qualified Legal Review Notes (consolidated list of inline review-required callouts grouped by counsel competence) + signature blocks.
The output is anchored on the regulations that apply to AI deployments in ZA. The top frameworks cited:
Chapter 3 (Conditions 1–8) — Eight conditions for lawful processing • Section 26 — Processing of special personal information (health, biometric, child data) • Section 71 — Right to object to decisions based solely on automated processing • Section 22 — Notification to Information Regulator and data subjects
Electronic communications and cybersecurity baseline
Employers using AI in recruitment or employment decisions must ensure automated systems do not directly or indirectly discriminate on any ground listed in Section 6(1) EEA; must audit AI tools for discriminatory impact; and must ensure that final employment decisions remain subject to human review and can be explained to affected individuals and the Commission for Employment Equity.
Credit providers using AI for credit assessments must ensure automated models comply with Section 81 NCA affordability requirements; must not use AI to facilitate reckless credit granting; must provide applicants with reasons for adverse credit decisions; and must register with the National Credit Regulator (NCR), which has authority to audit algorithmic credit decision systems for discriminatory or reckless outcomes.
You describe your organisation, the AI vendor (Processor), the AI service being procured, and the categories of personal data the service will process. The tool maps your jurisdiction + industry + risk appetite into a structured, schedule-based DPA ready to redline with your legal team.
The DPA follows the format working contract lawyers recognise — main clauses for the contractual body, schedules for the GDPR Art. 28(3) particulars (subject matter / duration / nature / purpose / data categories / data subject categories), schedules for the operational details (TOMs, sub-processors, transfer mechanism), and annexes for the AI-specific protections + negotiation positions + consolidated review-required notes. Risk-appetite-driven defaults (security standard, audit notice, breach window, liability cap, model-update notice) are internally consistent across clauses, schedules, and the negotiation checklist. This is an AI-assisted drafting aid intended to accelerate review by qualified data-protection counsel.
$39 · one-time — answer a 6-question intake (including jurisdiction = ZA), and download your tailored document immediately.
Generate DPA →Also available framed for your sector → see industry-specific pages