Data Controller Agreement Template

DATA CONTROLLER AGREEMENT

This Data Controller Agreement (the "Agreement") is entered into as of Effective Date: between Controller Name: with principal address: ("Controller") and Other Controller Name: with principal address: ("Other Controller") (each a "Party" and together the "Parties").

RECITALS

WHEREAS, each Party independently determines the purposes and means of processing certain personal data relating to individuals and will act as a data controller in respect of such personal data;

WHEREAS, the Parties intend to set out the terms under which they will process, protect, disclose and otherwise manage personal data that is shared between them in connection with their respective activities;

WHEREAS, the Parties agree to allocate responsibilities for compliance with applicable data protection laws and to record their respective obligations in this Agreement.

NOW, THEREFORE

In consideration of the mutual covenants contained herein and other valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms have the meanings set forth below:

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by either Party in connection with the activities contemplated by this Agreement. Categories of Personal Data exchanged under this Agreement are:

2. PURPOSE AND SCOPE

The Parties will share and process Personal Data solely for the following documented purposes:

Each Party warrants that it will only process Personal Data in a manner consistent with its role as a controller and in compliance with applicable data protection laws.

3. CONTROLLER RESPONSIBILITIES

Each Party, acting as a controller with respect to the Personal Data it collects and shares, shall:

(a) lawfully collect and process Personal Data only for the purposes set forth in Section 2; (b) maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access; and (c) ensure that any third parties to whom Personal Data is disclosed are bound by written contractual terms sufficient to protect Personal Data consistent with this Agreement.

4. DATA SUBJECT RIGHTS

Each Party shall, to the extent it is the controller with respect to a request, respond to requests from Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection) in accordance with applicable law. The Party receiving a request shall:

(a) notify the other Party of any request that reasonably appears to relate to the other Party's processing within calendar days; and (b) cooperate in good faith to ensure requests are handled within applicable legal timeframes.

5. SECURITY MEASURES

Each Party shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risks, including, as appropriate:

The Parties shall review such measures periodically and shall document security incidents and remedial measures.

6. BREACH NOTIFICATION

In the event of a confirmed personal data breach affecting Personal Data exchanged under this Agreement, the Party discovering the breach shall notify the other Party without undue delay and in any event within hours of discovery, providing sufficient details to enable the other Party to meet any obligations to notify supervisory authorities and Data Subjects. The notifying Party shall provide reasonable cooperation and assistance.

7. SUBPROCESSORS AND THIRD PARTIES

Each Party shall not transfer Personal Data to any third party acting as an independent controller without providing prior written notice to the other Party. Use of subprocessors, contractors or other service providers by a Party shall be subject to contractual obligations requiring protection of Personal Data at least as protective as this Agreement.

Authorized subprocessors or third parties (if any):

8. INTERNATIONAL TRANSFERS

Where Personal Data is transferred across national borders, the transferring Party shall ensure that such transfers are lawful and subject to adequate safeguards. Mechanisms to authorize transfers (if required) and the responsible Party are:

9. AUDIT AND COMPLIANCE

Each Party shall, upon reasonable notice, provide the other Party with information necessary to demonstrate compliance with this Agreement and allow for audits or inspections, subject to confidentiality protections and protection of commercially sensitive information. Audit frequency and scope:

10. LIABILITY

Except for liability arising from willful misconduct, gross negligence or breach of confidentiality or data protection obligations, each Party's aggregate liability under or in connection with this Agreement shall be limited to in the aggregate. This limitation shall not apply to liability for death or personal injury resulting from negligence or to other liabilities that cannot be excluded or limited by law.

11. CONFIDENTIALITY

Each Party shall treat Personal Data and any related proprietary information received from the other Party as confidential and shall not disclose such information to any third party except as permitted in this Agreement or required by law. Confidentiality obligations shall survive termination of this Agreement.

12. TERM AND TERMINATION

This Agreement shall commence on the Effective Date and remain in effect for years, unless earlier terminated by either Party for material breach or as otherwise agreed in writing. Upon termination, the Parties shall cease processing the other Party's Personal Data except as necessary to comply with legal obligations.

13. RETURN OR DESTRUCTION

Upon termination or expiration of this Agreement, the receiving Party shall, at the disclosing Party's election, return or permanently delete all Personal Data in its possession and certify in writing that such deletion or return has been completed, except where retention is required by applicable law. Retention exception and rationale (if any):

14. NOTICES

All notices required or permitted under this Agreement shall be in writing and sent to the addresses below:

15. AMENDMENT; WAIVER

No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both Parties. No failure or delay by either Party in exercising any right shall operate as a waiver of that right.

16. COUNTERPARTS

This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

17. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction selected by the Parties:

If any provision of this Agreement is held to be invalid or unenforceable, that provision shall be modified to the extent necessary to make it enforceable, and the remaining provisions shall remain in full force and effect. This Agreement constitutes the entire agreement between the Parties regarding the subject matter hereof and supersedes all prior agreements.

EXECUTION

The individuals signing below represent and warrant that they are authorized to execute this Agreement on behalf of their respective Parties.

Sign Now