Business DLP Template

BUSINESS DLP TEMPLATE

This Business Data Loss Prevention Agreement (the "Agreement") is entered into as of Effective Date: by and between Client Name: and Service Provider Name: .

WHEREAS

WHEREAS, Client operates business processes and systems that collect, store, transmit or otherwise process Sensitive Data as defined herein, and requires a program to mitigate the risk of unauthorized disclosure, exfiltration, or misuse of such data;

WHEREAS, Service Provider possesses technical expertise and will provide Data Loss Prevention (DLP) design, deployment and managed services to identify, prevent and respond to data leakage incidents in accordance with the terms of this Agreement;

WHEREAS, the parties wish to set forth their respective responsibilities, service scope, payment terms, confidentiality obligations and dispute resolution provisions applicable to the DLP engagement.

DEFINITIONS

Sensitive Data: any information that, if disclosed, could materially harm the Client or its customers, including personally identifiable information, financial account information, protected health information, trade secrets, or other information designated by Client in writing as confidential.

SCOPE OF WORK

Deliverables: Design documentation, DLP policy definitions and rule sets, deployment of agents or gateway configurations as specified, monitoring configuration, incident response playbooks and staff training as detailed in the Scope of Work above.

DATA CLASSIFICATION & HANDLING

Client designates the following classification levels for use in DLP policies (check all that apply):

Personally Identifiable Information (PII)
Protected Health Information (PHI)
Confidential / Proprietary
Public

TECHNICAL CONTROLS & MONITORING

Service Provider shall implement and maintain technical controls reasonably designed to detect and prevent unauthorized transmission of Sensitive Data, including but not limited to:

• Content inspection and pattern matching
• Endpoint and network DLP agents or gateway enforcement
• Encryption and blocking controls as defined in the Scope of Work
• Centralized logging and alerting with retention consistent with regulatory obligations

INCIDENT RESPONSE

In the event of a suspected or confirmed data leakage incident involving Sensitive Data, Service Provider will notify Client's Incident Contact and follow the incident response procedures set forth below.

PAYMENT TERMS

Client will pay Service Provider for the services and deliverables described in the Scope of Work in accordance with the following terms.

TERM AND TERMINATION

This Agreement shall commence on Start Date: and continue until End Date: , unless earlier terminated as provided herein.

Either party may terminate this Agreement for material breach that remains uncured for the notice period above. Termination shall not relieve Client of obligation to pay for services performed through the effective date of termination. Upon termination, Service Provider shall, at Client's election, return or securely destroy Client Sensitive Data in its possession and provide written certification of destruction where applicable.

CONFIDENTIALITY

Each party shall maintain the confidentiality of the other's Confidential Information using at least the same standard of care it uses to protect its own confidential information, but in no event less than reasonable care. Confidential Information includes but is not limited to Sensitive Data, security controls, and non-public business information. Confidential Information shall not be disclosed except to authorized personnel who have a need to know and are bound by confidentiality obligations no less restrictive than those herein. Obligations under this clause survive termination for a period of five (5) years or longer where required by applicable law.

TRAINING, AUDIT RIGHTS AND COMPLIANCE

Service Provider shall provide training to Client's designated staff on use of DLP controls as specified in the Scope of Work. Client shall have the right to audit Service Provider's compliance with the technical and procedural requirements of this Agreement upon reasonable notice and during normal business hours; audits shall be limited to once per twelve-month period unless a material security incident has occurred.

LIMITATION OF LIABILITY

Except for willful misconduct or gross negligence, neither party shall be liable to the other for indirect, incidental, consequential, special or punitive damages. Service Provider's aggregate liability arising out of or related to this Agreement shall not exceed the total fees paid by Client to Service Provider under this Agreement during the twelve (12) months preceding the claim.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflict of laws principles. The parties submit to the exclusive jurisdiction of the state and federal courts located within that state for resolution of disputes arising under this Agreement.

ENTIRE AGREEMENT

This Agreement, including any exhibits and the Scope of Work, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral. Any amendment or waiver must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS

If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. Neither party may assign this Agreement without the prior written consent of the other, except to an affiliate or in connection with a merger or sale of substantially all assets, provided that the assignee assumes the assigning party's obligations hereunder.

Sign Now