How to Translate a Data Processing Agreement in the US
A US organization translates a data processing agreement (DPA) to make it understood and enforceable by the other party. No single US federal law requires it for ordinary commercial DPAs. Some state and sector rules do. The translation needs a controlled source file, a approved glossary, clause-by-clause legal review, a stated controlling language, and a vendor bound by confidentiality, access control and an audit trail.
Table of Contents
What is a data processing agreement and what does translation change?
A DPA is a contract between a controller and a processor. The controller determines the purposes and means of processing. The processor processes personal data on the controller’s behalf and only on its instructions. The EDPB explains that a controller–processor relationship must be governed by a contract documenting the processing.
Roles follow facts, not labels. The Dutch Data Protection Authority states that the actual role of an organization, not the name used in the agreement, determines whether it is a controller or a processor. A translation must therefore preserve the role language exactly. It cannot reassign roles through word choice.
Scope of a DPA translation
The scope covers the following documents:
The DPA body and definitions.
Schedules and annexes: description of processing, security measures, subprocessor list.
Standard contractual clauses or transfer addendums attached to the DPA.
Related instructions, such as data-subject request procedures and breach notification forms.
The scope excludes the underlying master services agreement unless the parties decide to translate it too. Each document in scope needs the same glossary and the same version control.
Is translation of a DPA legally required in the US?
For most commercial DPAs between businesses, no general US rule requires a translation. Requirements arise from the transaction type, the state and the recipient.
State language rules
California Civil Code §1632(b) requires a translation, delivered before execution, into the language in which the agreement was primarily negotiated. The listed languages are Spanish, Chinese, Tagalog, Vietnamese and Korean. It applies to agreements the statute covers, including specified consumer transactions and qualifying commercial-space leases. The text is in the California Civil Code. A standalone business-to-business DPA is generally not one of those listed categories. Counsel confirms this for each contract.
Sector rules
If a DPA forms part of a regulated consumer transaction, sector language rules can apply. The CFPB’s 2021 statement on limited English proficient consumers says institutions must comply with federal and state laws requiring translated documents in specified circumstances. Otherwise they assess whether to provide translations. Texas retail electric rules offer another example. 16 Tex. Admin. Code § 25.473 requires covered providers to give specified information in English, Spanish, or the language used to market service.
Contractual and counterparty reasons
Most DPA translations are driven by the counterparty, not by statute. Examples are an EU subsidiary whose works council or regulator expects a local-language document, or a German or French customer that requires a local-language version in procurement. Certification, such as a translator’s affidavit, is a business or recipient requirement. The American Bar Association recommends obtaining a translator certification or affidavit where appropriate.
Which laws shape the content of the DPA being translated?
The translator does not choose the legal content. The governing law does. The translation must carry it faithfully.
GDPR Article 28
Under GDPR Article 28, the agreement must cover the subject matter, duration, nature and purpose of processing, the types of personal data, the categories of data subjects, and the controller’s rights and obligations, as the Irish Data Protection Commission describes. The EDPB adds required terms: processing only on documented instructions, confidentiality, security, subprocessor authorization, assistance with data-subject rights and security obligations, deletion or return, compliance information, and audits. The Dutch authority states that Article 28 requires a written agreement and that both controller and processor can be liable when it is missing.
Transfers to US processors
The Data Privacy Framework program explains that an EU/EEA, UK or Swiss controller must use a contract when it transfers personal data to a processor. This holds whether or not the US processor participates in the framework. The contract must require instruction-only processing, appropriate technical and organizational safeguards, rules for onward transfers and help with individuals’ rights. Special categories of data raise the stakes of terminology. For background on how EU courts read sensitive data, see this EU court ruling on sensitive data.
US state privacy laws
US requirements differ from GDPR. A National Law Review analysis states that the CCPA sets distinct contract requirements for service providers, contractors and third parties, and the required language differs among them. Other state laws vary. A Greenberg Traurig comparison reports that GDPR requires more detailed elements than several state laws, such as categories of data subjects, assistance with DPIAs and processor liability for subprocessors. It also reports that California’s CPRA adds items such as limits on sale or sharing for cross-context behavioral advertising. A translator who renders a GDPR clause into a US-facing document without checking US law can misstate an obligation.
What are the steps to translate a DPA, and who owns each control?
Step | Owner | Control |
1. Freeze the source draft | Legal counsel | One controlled source file, named revisions |
2. Define the brief | Privacy or compliance lead | Transaction, jurisdictions, audience, reference documents |
3. Approve the glossary | Counsel and vendor linguist | Approved term base for roles, data categories and rights |
4. Select the vendor | Procurement and security | Confidentiality terms, access control, audit trail |
5. Translate | Vendor linguist with subject expertise | Documented process, QA check |
6. Review clause by clause | Bilingual counsel | Written review comments, tracked changes |
7. Resolve queries | Counsel | Query log closed before signature |
8. Execute | Contract owner | Controlling-language clause, signature of each version |
Step 1 and 2: stabilize and brief
A practical workflow from translation guidance starts by stabilizing the source draft. The team then gives the translator the transaction, the jurisdictions, the audience, reference documents and a glossary. Unresolved provisions are flagged before translation starts, so the translator does not guess.
Step 3: glossary
Terms such as controller, processor, subprocessor and personal data carry jurisdiction-specific legal meaning. Near-synonyms can widen or narrow obligations. The glossary fixes each term once and applies it across the agreement, schedules and annexes. If the organization already holds a translation memory and term base from earlier contracts, it supplies them to the vendor.
Step 4: vendor controls
The vendor handles personal data in annexes and may handle confidential commercial terms. The agreement with the vendor should set out the following controls:
A confidentiality obligation for every linguist and reviewer.
Access control limited to named staff on the project.
An audit trail showing who opened, edited and approved each file.
Encryption in transit and at rest.
Stated hosting location and rules on subprocessors.
Deletion or return of files after delivery.
These mirror the Article 28 duties the DPA itself imposes, so the translation vendor should meet the same standard as the processor in the document.
Step 6: clause-by-clause review
The ABA recommends using a lawyer fluent in both languages or an appropriately experienced legal translator, and reviewing the translation clause by clause. Its guidance treats multilingual drafting as a risk and interpretation problem, because a fluent but imprecise translation can change the bargain. Review checks meaning, not style.
Which language version controls if the versions differ?
The agreement must say. The ABA guidance advises stating expressly which language version controls if versions conflict. For example, the English version prevails, or one specified language version applies and binds the parties.
California shows why the clause matters. Under §1632(j), the English contract determines the parties’ rights and obligations. The translation may be evidence that no contract was formed if material terms differ substantially. The statute does not make every version equally authoritative.
A controlling-language clause should name the version, state that other versions are for convenience or reference, and be present in every language version. Each party signs each version, per the ABA recommendation.
What decision criteria separate translation options?
Criterion | What to check |
Legal review | Bilingual counsel or legal translator reviews every clause |
Terminology governance | Approved glossary, term base and translation memory used |
Confidentiality | Signed obligations, named personnel, access control |
Data location | Hosting region stated and compatible with the DPA’s transfer terms |
Audit trail | Logs of file access and edits, available on request |
Certification | Independent audit of quality and security standards, such as ISO 17100 and ISO 27001 |
Process | Translation, expert review and QA as separate steps |
Version control | One source file, named revisions, query log |
If any AI is used in the workflow, state it. Machine translation and neural machine translation are not the same as an AI+HUMAN hybrid process with documented human expert review. The DPA’s confidentiality terms should cover whichever tool is used, and public tools without data controls are unsuitable for agreements containing personal data or confidential terms.
What do real DPA translation cases look like?
Example 1: US SaaS company with a German customer
A US software processor signs a DPA with a German controller. The customer asks for a German version for its data protection officer. The US company freezes the English draft, supplies a glossary for controller, processor and subprocessor, and has German-qualified counsel review it. The agreement states which version controls and both versions are signed.
Example 2: Medical device company with an EU subsidiary
A US device manufacturer shares clinical data with a processor in France. The annex lists categories of health data. The translator uses approved terms for special categories of data. Counsel confirms that the French terms match the legal concepts in the English source, and the vendor works inside a restricted-access project.
Example 3: California consumer-facing agreement
A US business negotiates a covered consumer agreement in Spanish. Counsel checks whether §1632 applies and, if so, delivers the Spanish translation before execution. The English contract governs rights and obligations. A separate DPA with a business vendor does not trigger the same rule on its own.
What failure modes occur and how are they mitigated?
Failure mode | Effect | Mitigation |
Inconsistent terms for controller or processor | Roles and liability shift | Approved glossary applied across all documents |
GDPR clause carried into a US-facing DPA unchecked | Misstated obligation under CCPA or other state law | Counsel maps clauses to the governing law before translation |
No controlling-language clause | Dispute over which text binds | Express clause in every version |
Draft changes during translation | Versions diverge | One controlled source file, named revisions |
Annexes translated separately | Terms differ from the body | Single project, shared term base |
Personal data in files sent to uncontrolled tools | Confidentiality breach | Vendor access control, confidentiality terms, stated hosting |
No review by counsel | Fluent text with changed meaning | Clause-by-clause legal review |
Only one version signed | Unsigned version has weaker standing | Each party signs each version |
Perspective: why DPA translation is a controls problem
We treat a DPA translation as a controlled legal deliverable, not as a language task. The words in a DPA allocate liability. A processor that appears as a service provider in one clause and a third party in another has changed its duties. We see the same failures repeatedly: unmanaged terminology, annexes translated apart from the body, and personal data moved through tools no one approved. Each has a control that prevents it. Those controls are a governed term base, one source file, restricted access, an audit trail and expert review. Our position is that AI+HUMAN hybrid translation fits this work when the AI runs on private, EU-hosted infrastructure and every output is reviewed by a subject-matter expert. The AI gives speed and consistency against the client’s own term base. The expert gives legal accuracy. Neither replaces counsel’s final review of a signed agreement. Eric Brown
Where does AD VERBUM fit?
AD VERBUM provides AI+HUMAN hybrid translation and localization for legal documentation, including agreements and annexes. Its proprietary LangOps System runs on EU-hosted servers. It integrates client translation memories and term bases. It holds ISO 17100, ISO 18587, ISO 27001 and ISO 42001 certifications, audited by Bureau Veritas, and aligns to GDPR. Details are on the translation and localization services page.
Pricing is by quote.
Key points
No general US rule requires translating an ordinary commercial DPA. State and sector rules can.
California Civil Code §1632 requires a pre-execution translation only for covered agreements.
GDPR Article 28 content must survive translation unchanged, including instructions, subprocessors, audits and deletion.
US state privacy laws use different contract terms from GDPR. Counsel maps each clause before translation.
An approved glossary keeps role and data terms consistent across the body and annexes.
Bilingual counsel reviews the translation clause by clause.
The agreement states which language controls, and each party signs each version.
The translation vendor needs confidentiality terms, access control and an audit trail.
FAQ
Does a DPA translation need a certified translator?
Not by default for an ordinary commercial DPA. Certification is a recipient or jurisdiction requirement, for example when a court or agency receives the document. The ABA recommends a translator certification or affidavit where appropriate. Ask the counterparty and counsel before the work starts.
Which version of a translated DPA is legally binding?
The one the agreement says controls. Without a clause, the parties risk dispute. California §1632(j) treats the English contract as determining rights and obligations for covered agreements. State the controlling language expressly in every version.
Can a US processor use a DPA based on GDPR Article 28?
Yes for transfers from EU controllers, since the Data Privacy Framework program describes a required contract for transfers to processors. For US data, state laws such as the CCPA have their own terms. Counsel checks both sets before translation.
Who should review a translated DPA?
A lawyer fluent in both languages, or an experienced legal translator, reviewing clause by clause. The privacy or compliance lead checks that glossary terms match the roles in the agreement. Review comments and approvals should be recorded.
Sources
CFPB Statement on Limited English Proficient Consumers, Federal Register, 2021
Data Protection Commission (Ireland): Controller and Processor relationships
Data Privacy Framework: Contract requirements for transfers to a processor
National Law Review: Contracting requirements under US privacy laws
American Bar Association: Drafting Multiple-Language Contracts