Data Processing Agreement & Information Disclosure Document

DATA PROCESSING AGREEMENT & INFORMATION DISCLOSURE DOCUMENT

This Data Processing Agreement & Information Disclosure Document (the Agreement) is made and entered into as of Day: Month: Year: by and between Controller Name: principal place of business: (Controller) and Processor Name: principal place of business: (Processor).

RECITALS

WHEREAS, Controller determines the purposes and means of Processing personal data in connection with its business operations and desires to engage Processor to process certain personal data on Controller's behalf; and

WHEREAS, Processor provides services that involve access to and Processing of personal data and is willing to process such personal data subject to the terms and conditions set forth in this Agreement; and

WHEREAS, the parties intend by this Agreement to set forth the parties' respective rights and obligations with respect to the Processing of personal data and any required disclosures under applicable data protection law.

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows:

1. DEFINITIONS

1.1 For purposes of this Agreement, the following terms have the meanings set forth below: "Personal Data" means any information relating to an identified or identifiable natural person that is provided to or collected by Processor on behalf of Controller in connection with the Services; "Processing" means any operation or set of operations performed on Personal Data; "Sub-processor" means any Processor engaged by Processor to carry out Processing activities on behalf of Controller; and "Applicable Data Protection Law" means any law applicable to the Processing of Personal Data under this Agreement.

2. SCOPE AND DETAILS OF PROCESSING

3. PROCESSOR OBLIGATIONS

3.1 Processor shall process Personal Data only on documented instructions from Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by Applicable Data Protection Law. Controller's documented instructions (if any) are detailed as follows:

3.2 Processor shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction or damage. Processor describes the measures it will implement as follows:

3.3 Processor shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. CONTROLLER OBLIGATIONS

4.1 Controller shall ensure that it has all necessary rights and lawful basis to provide Personal Data to Processor for the Processing and to instruct Processor for such Processing. Controller shall provide timely written instructions where required by Applicable Data Protection Law.

5. SECURITY MEASURES

5.1 Processor represents that it will maintain and regularly test technical and organizational measures appropriate to the risk, including measures to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services.

6. SUB-PROCESSING

6.1 Controller hereby authorizes Processor to engage Sub-processors as necessary to perform the Services. Processor shall provide Controller with prior written notice of any intended changes concerning the addition or replacement of Sub-processors and shall allow Controller the opportunity to object for reasonable grounds. Notice period in days:

7. INTERNATIONAL TRANSFERS

7.1 Any transfers of Personal Data outside the country of collection shall be carried out only on the basis of a lawful transfer mechanism under Applicable Data Protection Law. The parties agree the following mechanism(s) shall apply to transfers:

8. DATA SUBJECT RIGHTS

8.1 Processor shall assist Controller, taking into account the nature of the Processing and the information available to Processor, in fulfilling Controller's obligation to respond to Data Subject requests. Contact for data subject requests at Controller:

9. BREACH NOTIFICATION

9.1 Processor shall notify Controller without undue delay after becoming aware of a Personal Data breach involving Controller's Personal Data and, where feasible, provide a written description of the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed to remedy the breach. Notification period in hours:

10. RETURN OR DELETION OF PERSONAL DATA

10.1 Upon termination or expiry of the Services, Processor shall, at Controller's choice, return all Personal Data to Controller or securely delete all Personal Data unless retention is required by Applicable Data Protection Law. Controller's preference and instructions:

11. AUDIT RIGHTS

11.1 Controller or an independent auditor mandated by Controller shall have the right to audit Processor's compliance with this Agreement, subject to reasonable notice, confidentiality obligations and the protection of Processor's trade secrets. Auditor access and frequency:

12. CONFIDENTIALITY

12.1 Each party shall keep confidential all information disclosed by the other party in connection with this Agreement that is designated as confidential or that, given the nature of the information, should reasonably be understood to be confidential. The receiving party shall not disclose such information except to those employees, agents and Sub-processors who need to know for the performance of this Agreement and who are bound by confidentiality obligations at least as protective as those contained herein.

13. LIABILITY AND INDEMNIFICATION

13.1 Each party shall be liable for and shall indemnify the other against any losses, liabilities, damages, costs and expenses arising from its breach of this Agreement or Applicable Data Protection Law. Notwithstanding the foregoing, to the extent permitted by Applicable Data Protection Law, the parties agree that Processor's aggregate liability arising out of or relating to this Agreement shall not exceed:

14. INSURANCE

14.1 Processor shall maintain appropriate insurance coverage adequate to cover liabilities arising under this Agreement. Insurance details:

15. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

15.1 This Agreement shall be governed by and construed in accordance with the laws of:

15.2 If any provision of this Agreement is found to be invalid or unenforceable, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions shall remain in full force and effect.

15.3 This Agreement contains the entire understanding of the parties with respect to the subject matter hereof and supersedes all prior agreements, representations and understandings, whether written or oral, relating to such subject matter.

16. NOTICES

16.1 All notices, requests, consents and other communications under this Agreement shall be in writing and delivered to the addresses below or to such other address as either party may designate by written notice to the other.

17. AMENDMENT; WAIVER; COUNTERPARTS

17.1 No amendment or modification of this Agreement shall be effective unless in writing and signed by duly authorized representatives of both parties. No failure or delay by either party in exercising any right shall operate as a waiver of that right. This Agreement may be executed in counterparts, each of which shall be deemed an original.

Sign Now