Data Protection PII Document

Data Protection PII Document

Parties

Client Name:   Service Provider Name:

Recitals

WHEREAS, Client collects, stores, or otherwise processes personally identifiable information ("PII") in the course of its business and requires certain processing, hosting, or other services from Service Provider that will involve access to or handling of such PII; and

WHEREAS, Service Provider has represented that it maintains administrative, technical, and physical safeguards sufficient to protect PII, and the parties desire to set forth their respective obligations with respect to the handling, protection, retention, breach notification, and permitted uses of PII;

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows:

Definitions

"PII" means any information that identifies or can be used to identify an individual, including but not limited to name, postal address, email address, telephone number, government-issued identifiers, and other sensitive personal data as identified in this Document.

Scope of Work

Processing Purpose(s):

Types of PII

Identify types of personal data to be processed (check all that apply):

Name    Email address    Telephone number    Government ID / SSN    Financial account information

Security and Data Handling

Service Provider shall implement and maintain administrative, technical, and physical safeguards appropriate to the risk, including but not limited to encryption in transit and at rest where appropriate, access controls, multi-factor authentication for privileged accounts, regular vulnerability management, and secure disposal procedures. Specific measures required by Client:

Subprocessing: Service Provider shall not subcontract or engage subprocessors to process PII without prior written consent of Client. If subprocessors are engaged, Service Provider shall impose equivalent data protection obligations and remain liable for their performance.

Audits: Client shall have the right to audit or inspect Service Provider's security controls; audit frequency:

Breach Notification

In the event of a confirmed or suspected data breach affecting PII, Service Provider shall notify Client without undue delay and, in any event, within of discovery. Notification shall include a description of the nature of the breach, categories of affected data subjects and PII, likely consequences, remedial actions taken or proposed, and contact information for follow-up.

Data Retention and Deletion

Service Provider shall retain PII only for the duration necessary to perform the Services or as required by law. Upon termination or expiry of this Document, Service Provider shall, at Client's election, securely return or securely delete all PII within .

Payment Terms

Late Fee: If any amount due is not paid within days after invoice date, a late fee of will be applied.

Term and Termination

Effective Date: .   Term End Date:

Either party may terminate this Document for convenience upon days' prior written notice to the other party. Either party may terminate immediately upon material breach by the other party if such breach is not remedied within thirty (30) days of written notice specifying the breach.

Confidentiality

Each party shall keep confidential and shall not disclose PII or Confidential Information except as permitted by this Document. Confidential Information excludes information that is or becomes publicly known without breach, already in the receiving party's lawful possession, rightfully obtained from a third party, or independently developed. The receiving party shall restrict access to Confidential Information to personnel with a need to know and shall require such personnel to be bound by confidentiality obligations at least as protective as those in this Document.

Liability and Indemnification

Each party shall indemnify, defend and hold harmless the other party from liabilities, losses, damages, penalties, and reasonable costs (including attorneys' fees) arising from the indemnifying party's breach of this Document, negligence, or willful misconduct. To the extent permitted by law, the parties' aggregate liability under this Document shall not exceed the total fees paid to Service Provider under this Document in the twelve (12) months preceding the claim.

Governing Law

This Document shall be governed by and construed in accordance with the laws of: without regard to conflict of law principles.

Entire Agreement; Amendments

This Document, together with any exhibits or appendices expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, proposals, and understandings, whether written or oral. Any amendment or modification must be in writing and signed by duly authorized representatives of both parties.

Miscellaneous Provisions

Notices shall be in writing and delivered to the addresses set forth above. If any provision of this Document is held to be invalid or unenforceable, the remainder shall remain in full force and effect. The parties are independent contractors and nothing in this Document creates a partnership, joint venture, employment relationship, or agency.

Acknowledgments

Each party represents and warrants that it has the full right, power, and authority to enter into and perform this Document and that performance will not violate any other agreement or applicable law.

Sign Now