Cyber Security GDPR Compliance Template

Cyber Security GDPR Compliance Template

Parties

Recitals

WHEREAS, Client Name: (the "Data Controller") seeks to engage the Service Provider to assess, design and implement cyber security measures to ensure processing activities comply with applicable data protection law, including the GDPR; and

WHEREAS, Service Provider Name: (the "Data Processor") has represented that it possesses the technical expertise and organizational measures necessary to provide cyber security services and assist with GDPR compliance; and

WHEREAS, the parties wish to set out the scope, security obligations, data processing instructions, reporting and commercial terms under which processing of personal data will be carried out;

Scope of Work

Describe the services, deliverables and acceptance criteria. This Scope of Work forms part of the Agreement and governs the specific cybersecurity and GDPR-related tasks to be performed.

Payment Terms

The Client will pay the Service Provider for the services described above in accordance with the schedule set forth below. All amounts are exclusive of taxes unless otherwise stated.

Late payments shall incur a late fee. The late fee shall accrue at: from the due date until payment in full. The Service Provider may suspend services for overdue invoices after days' prior written notice.

Term and Termination

This Agreement commences on the Start Date and continues until the End Date unless earlier terminated in accordance with this section.

Start Date:    End Date:

Either party may terminate this Agreement for convenience by providing days' prior written notice. Either party may terminate immediately upon written notice where the other party materially breaches its obligations and fails to cure within days of receipt of notice specifying the breach.

Confidentiality

Each party shall treat as confidential all Confidential Information received from the other party and shall not disclose such information except as permitted by this Agreement. Confidential Information includes technical, business and personal data processed under this Agreement.

Data Processing & GDPR Compliance

The parties acknowledge that, for the purposes of applicable data protection law, the Client is the Data Controller and the Service Provider is the Data Processor for the Processing Activities described below. The Processor shall process personal data only on documented instructions of the Controller and shall implement and maintain appropriate technical and organizational measures.

Data Storage Location:

  Service Provider may engage subprocessors subject to written obligations no less protective than this Agreement.

Security Measures

The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as applicable the following measures:

  Encryption of data at rest and in transit.

  Access controls, least privilege and multi-factor authentication.

  Continuous monitoring, logging and retention of security event records.

The Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach and shall provide all information necessary for the Controller to meet its obligations. Initial notification shall be provided within hours of becoming aware of the breach.

Liability and Indemnity

Each party's liability for direct damages arising from a breach of its obligations under this Agreement shall be limited as set forth below, except in cases of gross negligence, willful misconduct or breach of confidentiality and data protection obligations.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of: without regard to conflicts of laws principles. The parties submit to the exclusive jurisdiction of the competent courts in that jurisdiction for disputes arising out of this Agreement, subject to mandatory statutory protections.

Entire Agreement

This Agreement, together with any appendices, exhibits and mutually executed statements of work, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and understandings, whether written or oral. Any amendment must be in writing and signed by authorized representatives of both parties.

Representations and Certifications

Each party represents and warrants that it has full power and authority to enter into this Agreement and that the execution, delivery and performance of this Agreement will not violate any other agreement by which it is bound. The Service Provider certifies that it will implement and maintain technical and organizational measures appropriate to the risk, and will assist the Controller in meeting its GDPR obligations as set out in this Agreement.

Sign Now