Data Processing Agreement Schedule

DATA PROCESSING AGREEMENT SCHEDULE

This Data Processing Agreement Schedule (this Schedule) is entered into as of Effective Date: by and between Controller Name: with principal address: and Processor Name: with principal address: .

RECITALS

WHEREAS, the Controller and the Processor are parties to a written agreement identified as Master Agreement dated (the Agreement), pursuant to which Processor will process certain Personal Data on behalf of Controller; and

WHEREAS, the parties agree that certain processing operations, security obligations, and other terms applicable to the processing of Personal Data shall be set forth in this Schedule in order to ensure compliance with applicable data protection laws and to document the parties' roles and responsibilities.

WHEREAS, the Controller wishes to ensure that the Processor implements appropriate technical and organisational measures and that the Processor shall only process Personal Data in accordance with Controller's documented instructions as set forth herein.

NOW THEREFORE, in consideration of the mutual covenants contained herein, the parties agree as follows:

1. DEFINITIONS

1.1. In this Schedule, the following terms shall have the meanings set out below: "Personal Data" means any information relating to an identified or identifiable natural person processed by Processor on behalf of Controller under the Agreement; "Processing" has the meaning given in applicable data protection law and includes any operation or set of operations performed on Personal Data; "Data Subject" means the identified or identifiable natural person to whom the Personal Data relates; "Sub-processor" means any Processor engaged by Processor to assist in fulfilling its obligations with respect to the Agreement; "Security Incident" means a confirmed or reasonably suspected breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

2. PURPOSE AND SCOPE

2.1. Purpose. Processor shall process Personal Data on behalf of Controller for the purposes described below. Processor shall only process Personal Data for the documented purposes and in accordance with Controller's documented instructions.

3. PROCESSING INSTRUCTIONS AND DETAILS

3.1. Controller's Instructions. Processor shall process Personal Data only on documented instructions from Controller. Any request by Processor to process Personal Data for a purpose other than the documented instructions shall be subject to Controller's prior written instruction.

4. SPECIAL CATEGORIES OF DATA

4.1. Processing of Special Category Data. The parties acknowledge whether the processing involves special categories of personal data or criminal conviction data.

Yes No

5. SUB-PROCESSORS

5.1. Use of Sub-processors. Controller hereby authorises Processor to engage Sub-processors for the processing activities described in this Schedule subject to the following conditions.

5.2. Prior Notice and Approval. Processor shall provide Controller with written notice of any addition or replacement of Sub-processors and shall obtain Controller's prior written objection, which shall not be unreasonably withheld, within a reasonable review period.

Controller provides a standing authorization for Processor to engage Sub-processors subject to Processor's standard contract terms with equivalent data protection obligations.

6. INTERNATIONAL TRANSFERS

6.1. Transfers to Third Countries. Transfer of Personal Data outside the country(ies) where it was collected shall occur only if appropriate safeguards are in place to ensure an adequate level of protection for the rights of Data Subjects.

Standard contractual clauses or substantially equivalent contractual safeguards
Binding corporate rules
Other (specify below)

7. TECHNICAL AND ORGANISATIONAL MEASURES

7.1. Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Such measures shall be appropriate to the risks presented by the processing and shall include, as appropriate:

Encryption of Personal Data at rest and in transit
Role-based access controls and least privilege
Pseudonymization where appropriate
Audit logging and monitoring
Regular backups and tested restore procedures
Regular vulnerability assessments and penetration testing

8. SECURITY BREACH NOTIFICATION

8.1. Notification Obligation. Processor shall notify Controller without undue delay upon becoming aware of a Security Incident affecting the Controller's Personal Data and shall provide sufficient information to allow Controller to meet any notification obligations to supervisory authorities and Data Subjects.

9. AUDIT AND INSPECTION

9.1. Audit Rights. Controller or an independent auditor appointed by Controller shall have the right, upon reasonable notice and subject to confidentiality obligations, to conduct audits or inspections of Processor's facilities, systems and records to ensure compliance with this Schedule. Such audits shall be conducted during normal business hours and in a manner designed to minimize disruption to Processor's operations.

10. DATA SUBJECT RIGHTS

10.1. Assistance. Processor shall assist Controller, insofar as reasonably possible, by appropriate technical and organisational measures, for the fulfilment of Controller's obligation to respond to requests from Data Subjects to exercise their rights under applicable data protection law.

11. RETURN OR DELETION OF PERSONAL DATA

11.1. At the end of the provision of services related to processing, Processor shall, at Controller's choice, return all Personal Data to Controller and delete existing copies, except to the extent retention is required by applicable law. If retention is required by law, Processor shall isolate and protect the Personal Data and inform Controller of the legal requirement.

Return all Personal Data to Controller
Permanently delete all Personal Data from Processor systems

12. LIABILITY

12.1. Each party's liability arising from or related to Personal Data shall be subject to the limitations and indemnities set forth in the Agreement, provided that nothing in the Agreement shall exclude or limit liability for fraud, wilful misconduct, or liability that cannot be limited by applicable law.

13. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

13.1. Governing Law. This Schedule shall be governed by and construed in accordance with the law specified in the Agreement or, if no law is specified, the law of the jurisdiction of the Controller.

13.2. Entire Agreement. This Schedule, together with the Agreement, constitutes the complete and exclusive statement of the parties' agreement with respect to the subject matter of this Schedule and supersedes all proposals, representations and prior agreements, whether oral or written.

13.3. Severability. If any provision of this Schedule is held to be invalid or unenforceable, that provision shall be enforced to the maximum extent permitted by applicable law and the remaining provisions shall remain in full force and effect.

14. NOTICES; AMENDMENTS; WAIVER; COUNTERPARTS

14.1. Notices. All notices required or permitted under this Schedule shall be given in writing to the address set out below for each party and shall be effective upon receipt.

14.2. Amendments. Any amendment to this Schedule must be made in writing and signed by authorised representatives of both parties.

14.3. Waiver. No failure or delay by either party to exercise any right under this Schedule shall constitute a waiver of that right.

14.4. Counterparts. This Schedule may be executed in counterparts and facsimile or electronic signatures shall be deemed originals for all purposes.

Sign Now