GDPR Compliance Document

GDPR COMPLIANCE DOCUMENT

This Data Processing Addendum (the "Addendum") is entered into as of by and between Controller Name: , registered address (the "Controller"), and Processor Name: , registered address (the "Processor"). The Controller and Processor are referred to collectively as the "Parties."

RECITALS

WHEREAS, the Parties have entered into a separate agreement governing the provision of services (the "Principal Agreement"), dated , pursuant to which the Processor may Process Personal Data on behalf of the Controller;

WHEREAS, the Parties intend by this Addendum to set out their respective rights and obligations with respect to the Processing of Personal Data in order to ensure compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable; and

WHEREAS, the Parties agree that this Addendum supplements and forms part of the Principal Agreement and governs Processing of Personal Data exchanged or processed under or in connection with that Principal Agreement.

NOW THEREFORE, in consideration of the mutual covenants contained herein and for other good and valuable consideration, the Parties agree as follows:

1. DEFINITIONS

For the purposes of this Addendum, the following terms shall have the meanings set out below: "Personal Data" means any information relating to an identified or identifiable natural person; "Processing" means any operation or set of operations performed on Personal Data; "Sub-processor" means any Processor engaged by the Processor; "Data Subject" means the individual to whom the Personal Data relates.

2. DETAILS OF PROCESSING

The Parties agree that the subject matter, duration, nature, and purpose of the processing, the types of Personal Data and categories of Data Subjects are described as follows.

3. CONTROLLER INSTRUCTIONS AND SCOPE

3.1 The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by applicable law. If the Processor is required to process Personal Data by applicable law, it shall notify the Controller of that legal requirement unless the law prohibits such notification.

3.2 The Processor shall not process Personal Data for any purpose other than for the performance of the Principal Agreement, for the purposes set out in this Addendum, or as otherwise instructed in writing by the Controller.

4. PROCESSOR OBLIGATIONS

4.1 The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, as appropriate, pseudonymisation and encryption of Personal Data, the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services, and a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.

4.2 The Processor shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. SUB-PROCESSORS

5.1 The Processor shall not engage any Sub-processor without prior specific or general written authorisation of the Controller. For general authorisations, the Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors, thereby giving the Controller the opportunity to object on reasonable grounds.

Controller authorises the Processor to engage Sub-processors under the terms of this Addendum.

6. DATA SUBJECT RIGHTS

6.1 Taking into account the nature of the processing, the Processor shall assist the Controller by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subject rights.

7. SECURITY BREACH NOTIFICATION

7.1 The Processor shall notify the Controller without undue delay and in any event within of becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Controller. The Processor's notification shall describe, to the extent possible, the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences and measures taken.

8. INTERNATIONAL TRANSFERS

8.1 The Processor shall not transfer Personal Data to a country outside the European Economic Area or a territory not subject to equivalent protection without implementing appropriate safeguards as required by applicable data protection law and without providing the Controller with written details of the transfer mechanism.

9. AUDIT AND INSPECTIONS

9.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Addendum and allow for and contribute to audits, including on-site inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality obligations.

10. RETURN OR DELETION

10.1 Upon termination or expiry of the Principal Agreement, the Processor shall, at the choice of the Controller, return all Personal Data to the Controller and delete existing copies unless applicable law requires storage of the Personal Data. Costs reasonably incurred by the Processor for returning or deleting data shall be borne as set out in the Principal Agreement.

11. LIABILITY AND INDEMNIFICATION

11.1 Each Party's liability arising under or in connection with this Addendum shall be subject to any limitations of liability set forth in the Principal Agreement, provided that nothing in this Addendum shall exclude or limit liability for death or personal injury resulting from negligence, or for willful misconduct, or for any liability which cannot be limited under applicable law.

11.2 The Processor shall indemnify the Controller for any losses incurred by the Controller arising from the Processor's breach of this Addendum, including breaches of security obligations and unauthorised processing, to the extent caused by the Processor's acts or omissions.

12. TERM AND TERMINATION

12.1 This Addendum shall commence on the Effective Date and shall continue in force for the duration of the Principal Agreement or for such period as the Processor Processes Personal Data on behalf of the Controller.

12.2 Termination of the Principal Agreement shall automatically terminate this Addendum unless otherwise expressly agreed in writing.

GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

Governing Law: This Addendum shall be governed by and construed in accordance with the laws specified in the Principal Agreement. In the absence of such specification, the Parties agree that the laws of the jurisdiction of the Controller's principal place of business shall govern.

Entire Agreement: This Addendum, together with the Principal Agreement, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes any prior written or oral agreements.

Severability: If any provision of this Addendum is held to be invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions shall not be affected or impaired.

NOTICES

AMENDMENTS; WAIVER; COUNTERPARTS

Amendments: This Addendum may only be amended by a written instrument executed by authorised representatives of both Parties. Waiver: Failure or delay by either Party to exercise any right shall not operate as a waiver. Counterparts: This Addendum may be executed in counterparts, each of which shall be deemed an original.

Sign Now