Data Protection Addendum Form

DATA PROTECTION ADDENDUM

This Data Protection Addendum ("Addendum") is entered into as of Effective Date: by and between Controller Name: with principal address: ("Controller"), and Processor Name: with principal address: ("Processor"). Controller and Processor are each a "Party" and collectively the "Parties."

RECITALS

WHEREAS, Controller and Processor are parties to an existing agreement under which Processor processes Personal Data on behalf of Controller (the "Agreement");

WHEREAS, the Parties wish to set out their respective rights and obligations regarding the processing, protection, transfer and security of Personal Data in compliance with applicable data protection law;

WHEREAS, this Addendum supplements and forms part of the Agreement and governs Processing of Personal Data by Processor on behalf of Controller.

NOW, THEREFORE

In consideration of the foregoing and the mutual covenants contained herein, the Parties agree as follows.

1. DEFINITIONS

For purposes of this Addendum, the following capitalized terms have the meanings set forth below: "Personal Data" means any information relating to an identified or identifiable natural person processed under the Agreement; "Processing" has the meaning given in applicable data protection law; "Subprocessor" means any Processor engaged by Processor to carry out Processing activities on behalf of Controller.

2. SUBJECT MATTER, DURATION, NATURE AND PURPOSES OF PROCESSING

3. INSTRUCTIONS AND ROLE OF PARTIES

Processor shall process Personal Data only on documented instructions from Controller, unless required to do otherwise by applicable law. Controller instructs Processor to process Personal Data for the purposes described in Section 2. Processor shall notify Controller if, in Processor's opinion, an instruction infringes applicable data protection law.

4. SECURITY MEASURES

Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as appropriate:

Encryption of Personal Data at rest and in transit
Access controls and role-based permissions
Pseudonymization and anonymization where feasible
Audit logging and intrusion detection
Personnel security measures and training
Other measures (describe)

5. SUBPROCESSING

Controller hereby authorizes Processor to engage Subprocessors as necessary for performance of the Agreement, subject to the restrictions below. Processor shall: (a) enter into a written contract with each Subprocessor imposing obligations substantially similar to those in this Addendum; (b) remain fully liable to Controller for the performance of Subprocessors' obligations; and (c) provide Controller with prior written notice of any intended appointment or replacement of a Subprocessor and a reasonable opportunity to object on reasonable data protection grounds.

6. INTERNATIONAL TRANSFERS

Processor shall not transfer Personal Data outside the jurisdiction(s) where it is collected except as permitted by applicable law and only where there is an adequate level of protection or appropriate safeguards. The Parties agree that transfers shall be governed by one or more lawful transfer mechanisms selected below.

Standard contractual clauses or equivalent safeguards
Adequacy decision or materially equivalent protection
Binding corporate rules
Other lawful basis or safeguards (describe)

7. DATA SUBJECT RIGHTS

Processor shall, taking into account the nature of the Processing, assist Controller by implementing appropriate technical and organizational measures to the extent reasonably possible to enable Controller to respond to requests from data subjects to exercise their rights under applicable data protection law. Processor shall not respond to a data subject request except on documented instructions from Controller unless required by law to do so.

8. PERSONAL DATA BREACH

Processor shall notify Controller without undue delay and, where legally required, no later than 72 hours after becoming aware of a Personal Data breach affecting Controller's Personal Data. Notification shall include, to the extent possible, the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, measures taken or proposed and a contact point for further information.

9. AUDIT AND INSPECTION

Controller shall have the right to audit Processor's compliance with this Addendum, including inspection of facilities and records, subject to reasonable notice and confidentiality obligations. Such audits shall be conducted no more frequently than once annually unless required by law or upon a documented material breach.

10. RETURN OR DELETION OF PERSONAL DATA

Upon termination or expiration of the Agreement, Processor shall, at Controller's choice, return all Personal Data to Controller and delete existing copies, or securely destroy all Personal Data, unless retention is required by applicable law. Processor shall certify in writing to Controller that it has complied with this obligation within the timeframe set forth below.

11. LIABILITY AND INDEMNITY

Each Party shall be liable for damages it causes by any breach of its obligations under this Addendum arising from negligence, willful misconduct or breach of applicable data protection law. Processor shall indemnify Controller against losses arising from Processor's breach of this Addendum, including breaches by Subprocessors, except to the extent caused by Controller's instructions or breach.

12. TERM; SURVIVAL

This Addendum shall commence on the Effective Date and shall continue in effect for the term of the Agreement. Provisions that by their nature should survive termination, including but not limited to liability, return or deletion of Personal Data, audit obligations and confidentiality, shall survive termination or expiration of this Addendum.

13. NOTICES

Any notice required or permitted under this Addendum shall be given in writing and delivered to the contact details of the relevant Party. Notices relating to data protection matters shall be sent to the data protection contacts specified below.

14. AMENDMENT; WAIVER; COUNTERPARTS

No amendment of this Addendum will be effective unless in writing and signed by authorized representatives of both Parties. No failure or delay by either Party to exercise any right under this Addendum shall constitute a waiver of that right. This Addendum may be executed in counterparts, each of which shall be deemed an original.

15. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

This Addendum shall be governed by and construed in accordance with the law specified in the Agreement. If any provision of this Addendum is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. This Addendum, together with the Agreement, constitutes the entire agreement between the Parties in respect of its subject matter and supersedes all prior agreements and understandings relating to such subject matter.

16. MISCELLANEOUS

Each Party represents and warrants that it has the legal authority to enter into this Addendum and that signing this Addendum does not violate any other agreement. The Parties shall cooperate in good faith to implement any additional reasonable measures required to comply with applicable data protection laws.

Sign Now