Data processing agreement (DPA)

Draft a data processing agreement as an exhibit to the master services agreement between an online learning platform (controller) and its customer support software vendor (processor); we are the controller. Purpose: define the vendor's obligations and limits when it handles learners' personal data. Requirements: describe the purposes, categories of personal data and data subjects, and require processing only on our instructions, security measures, prior authorization for subprocessors, conditions for cross-border transfers, a breach notification deadline, our audit rights, and return or deletion of data at termination, with three schedules covering processing details, security measures and subprocessors; leave governing law and the notice deadline blank for me to fill in. Use precise wording and note at the end that it is for reference only and must be reviewed by an attorney before signing.