GDPR Compliance Form

GDPR COMPLIANCE FORM

This GDPR Compliance Form is entered into as of Effective Date: by and between Controller Name: with registered address at , and Processor Name: with registered address at .

RECITALS

WHEREAS, Controller processes personal data in the course of its business and requires certain services from Processor that will involve the processing of personal data;

WHEREAS, Processor warrants that it has implemented and will maintain appropriate technical and organisational measures to protect personal data and comply with applicable data protection law; and

WHEREAS, the parties intend by this Form to set out the scope, nature and purpose of processing, the duration of processing, the types of personal data and categories of data subjects, and the respective obligations of the parties.

NOW THEREFORE, in consideration of the mutual covenants contained herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Form: "Personal Data" means any information relating to an identified or identifiable natural person; "Processing" has the meaning given in applicable data protection law; "Controller" and "Processor" have the meanings ascribed under applicable data protection law.

2. SCOPE OF PROCESSING

Categories of data subjects:   Retention period or criteria:

3. PROCESSOR OBLIGATIONS

Processor shall process Personal Data only on documented instructions of Controller, except to the extent required by applicable law, in which case Processor shall notify Controller of such legal requirement unless prohibited by law.

Processor certifies that it will implement and maintain technical and organisational measures appropriate to the risk, including as applicable:

  Access control and authentication mechanisms to limit access to authorized personnel

  Encryption of personal data in transit and, where appropriate, at rest

  Pseudonymisation and minimisation techniques where feasible

4. DATA SUBJECT RIGHTS

Processor will assist Controller, taking into account the nature of processing, by appropriate technical and organisational measures, to fulfil Controller's obligations to respond to requests to exercise data subject rights within the timeframes required by applicable law.

5. BREACH NOTIFICATION

Processor shall notify Controller without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach. Notification shall include sufficient detail to enable Controller to meet any obligations to supervisory authorities and affected data subjects.

Security breach contact at Processor: , Phone: , Email/contact method:

6. SUBPROCESSING

Processor shall not engage another processor without prior written authorisation of Controller. Where authorised, Processor shall impose on any subprocessor the same data protection obligations as set out in this Form and remain liable for the subprocessor's performance.

7. INTERNATIONAL TRANSFERS

Any transfer of Personal Data to jurisdictions outside the European Economic Area shall only occur where adequate protections are in place under applicable law. Processor shall implement appropriate safeguards and document any transfer mechanism relied upon.

8. AUDIT AND RECORDS

Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations laid down in applicable data protection law and allow for and contribute to audits, including inspections, by Controller or an auditor mandated by Controller, subject to reasonable notice and confidentiality protections.

Records maintained by Processor regarding processing activities:

9. CONFIDENTIALITY

Processor shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

10. LIABILITY AND INDEMNIFICATION

Each party's liability for breaches of this Form shall be subject to the limitation and exclusions set forth in the underlying services agreement between the parties. Processor shall indemnify Controller for losses arising from Processor's breach of its obligations under this Form to the extent such breach results from Processor's negligence or wilful misconduct.

11. TERM AND TERMINATION

This Form shall remain in force for the duration of the services for which Processor processes Personal Data and shall survive termination of the underlying services agreement to the extent necessary to allow Controller to exercise rights and Processor to fulfil obligations related to Personal Data. Upon termination, Processor shall, at Controller's choice, delete or return all Personal Data and certify deletion as required.

12. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

This Form is governed by the substantive laws chosen by the parties below. This Form, together with any underlying services agreement to which it is appended, constitutes the entire agreement of the parties in respect of the subject matter and supersedes all prior agreements and understandings. If any provision of this Form is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

13. NOTICES

All notices required or permitted under this Form shall be in writing and addressed to the parties at the addresses set out below (or such other address as either party may specify in writing).

14. AMENDMENTS; WAIVER; COUNTERPARTS

No amendment to this Form shall be effective unless in writing and signed by authorised representatives of both parties. The failure of either party to enforce any provision of this Form shall not constitute a waiver of future enforcement of that or any other provision. This Form may be executed in counterparts, each of which shall be an original.

15. CERTIFICATION

By signing below, Processor hereby certifies that, as of the Effective Date and during performance of the services, Processor will comply with the obligations set forth in this Form and applicable data protection law. Controller confirms that it has provided Processor with documented instructions sufficient for the Processing described above.

Sign Now