Data Processing Agreement 2024

DATA PROCESSING AGREEMENT 2024

This Data Processing Agreement ("Agreement") is entered into as of Day: Month: Year: (the "Effective Date") by and between Controller Name: , principal address: ("Controller") and Processor Name: , principal address: ("Processor").

RECITALS

WHEREAS, Controller determines the purposes and means of processing Personal Data and engages Processor to perform certain services that require Processor to process Personal Data on behalf of Controller; and

WHEREAS, Processor will process Personal Data only on documented instructions from Controller, subject to the terms of this Agreement, and will implement appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access; and

WHEREAS, the parties intend to ensure compliance with applicable data protection laws and to set out the respective obligations and responsibilities of Controller and Processor in relation to Personal Data processed under the parties' principal agreement:

NOW THEREFORE, in consideration of the mutual covenants and agreements herein, the parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is provided to or collected by Processor on behalf of Controller in connection with the services described in Schedule A.

1.2 "Processing", "controller", "processor" and "data subject" shall have the meanings given to them under applicable data protection law and shall include any successor definitions thereto.

2. DETAILS AND SCHEDULE OF PROCESSING

2.1 The subject-matter, duration, nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects are set forth in Schedule A attached hereto. Schedule A forms an integral part of this Agreement.

3. PROCESSOR OBLIGATIONS

3.1 Processor shall process Personal Data only on documented instructions from Controller, unless required to do otherwise by applicable law; in such case Processor shall inform Controller of that legal requirement unless prohibited by law from doing so.

3.2 Processor shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as set forth in the technical measures checklist below and in any additional security specifications agreed between the parties.

Encryption of data at rest and in transit
Role-based access controls and least privilege
Audit logging and monitoring of access
Pseudonymization where feasible
Regular backup and business continuity procedures

4. CONTROLLER OBLIGATIONS

4.1 Controller represents and warrants that it has all necessary rights and lawful grounds to transfer Personal Data to Processor for Processing under this Agreement and that Controller's instructions comply with applicable data protection law.

4.2 Controller shall respond to requests from Processor for instructions, consents or authorizations reasonably necessary for Processor to comply with applicable legal obligations.

5. SUB-PROCESSORS

5.1 Controller authorizes Processor to engage the sub-processors listed in the initial sub-processor list below and to replace or appoint additional sub-processors provided that Processor: (a) gives Controller prior written notice of the intended addition or replacement, and (b) enters into a written contract with the sub-processor imposing obligations no less protective than those imposed on Processor under this Agreement.

6. INTERNATIONAL TRANSFERS

6.1 Where Personal Data is transferred to jurisdictions that do not provide an adequate level of protection under applicable law, the parties shall ensure that appropriate safeguards are implemented, such as contractual safeguards, binding corporate rules, or other measures required by law.

7. DATA SUBJECT RIGHTS AND ASSISTANCE

7.1 Processor shall assist Controller, taking into account the nature of Processing and the information available to Processor, by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligation to respond to requests for exercising data subject rights.

8. SECURITY BREACHES AND INCIDENT NOTIFICATION

8.1 Processor shall notify Controller without undue delay after becoming aware of a Personal Data breach. Such notification shall: describe the nature and scope of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed to address the breach.

9. AUDIT AND INSPECTION

9.1 Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations laid down in this Agreement and allow for and contribute to audits, including inspections, conducted by Controller or an auditor mandated by Controller, subject to reasonable confidentiality protections for Processor's business information.

10. RETURN OR DELETION OF PERSONAL DATA

10.1 Upon termination or expiration of the services under the parties' principal agreement, Processor shall, at Controller's choice, return all Personal Data to Controller and delete existing copies unless retention of Personal Data is required by applicable law. Processor shall certify in writing the completion of such return or deletion.

11. CONFIDENTIALITY

11.1 Each party shall keep confidential any Personal Data and any information received from the other party that is designated confidential and shall not disclose such information except as permitted under this Agreement or required by law.

12. LIABILITY AND INDEMNITY

12.1 Each party's liability for breaches of this Agreement arising from its negligence or willful misconduct shall be governed by the liability provisions of the parties' principal agreement. To the extent such principal agreement does not address liability for data protection breaches, the parties agree that each party shall be liable for direct damages caused by its breach of this Agreement.

12.2 Processor shall indemnify and hold harmless Controller for losses arising from Processor's breach of its obligations under this Agreement, subject to any limitations set forth in the parties' principal agreement.

13. GOVERNING LAW; JURISDICTION

13.1 This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified below. Any dispute arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of that jurisdiction, except where mandatory law requires otherwise.

14. ENTIRE AGREEMENT; SEVERABILITY; AMENDMENT; WAIVER

14.1 This Agreement, together with any schedules and the parties' principal agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior proposals, agreements, representations and understandings. If any provision of this Agreement is held invalid or unenforceable, the remainder of the Agreement shall remain in effect. Any amendment or waiver of any provision of this Agreement must be in writing and executed by authorized representatives of both parties.

15. NOTICES

15.1 Any notice required or permitted under this Agreement shall be in writing and delivered to the notice contact details set out below or to such other address as a party may designate by notice in accordance with this Section.

16. COUNTERPARTS

16.1 This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Signatures delivered by electronic means shall be effective as original signatures.

Sign Now