GDPR Compliance Measures

GDPR Compliance Measures

This GDPR Compliance Measures Agreement (the Agreement) is entered into as of Effective Date: by and between Data Controller: with its principal place of business at , and Data Processor: with its principal place of business at . Each of Controller and Processor may be referred to individually as a Party and collectively as the Parties.

RECITALS

WHEREAS, Controller determines the purposes and means of the Processing of personal data and requires Processor to provide services that involve Processing of personal data;

WHEREAS, Processor will Process personal data on behalf of Controller and must implement and maintain appropriate technical and organizational measures consistent with applicable data protection law;

WHEREAS, the Parties wish to set forth the measures, assurances and procedures to ensure Processing is governed in accordance with the rights of data subjects and the obligations under applicable law.

NOW, THEREFORE, in consideration of the mutual covenants herein, the Parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms shall have the meanings set forth below: "Personal Data" means any information relating to an identified or identifiable natural person; "Processing" has the meaning given under applicable data protection law; "Data Subject" means an identified or identifiable natural person; "Subprocessor" means any processor engaged by Processor to carry out processing activities on behalf of Controller.

2. SUBJECT-MATTER, DURATION, NATURE AND PURPOSE OF PROCESSING

The subject-matter of Processing is: . The duration of Processing will be for the period necessary to perform the services or until termination of the contractual relationship. The nature of the Processing includes collection, storage, retrieval and transmission of Personal Data. The purpose of Processing is:

3. CATEGORIES OF DATA AND DATA SUBJECTS

Categories of Personal Data to be processed:

Categories of Data Subjects:

4. LAWFUL BASIS AND INSTRUCTIONS

Processor shall Process Personal Data only on documented instructions from Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by applicable law. Controller confirms the lawful basis for Processing: .

5. TECHNICAL AND ORGANIZATIONAL MEASURES

Processor warrants that it will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk including, as appropriate:

Encryption of data at rest and in transit

Role-based access controls and authentication

Pseudonymization and data minimization

Regular backups and secure storage

Audit logging and monitoring

Additional measures:

6. DATA PROTECTION IMPACT ASSESSMENTS

Where a Data Protection Impact Assessment (DPIA) is required for Processing activities, Processor shall provide reasonable assistance to Controller in conducting such DPIA, including provision of relevant internal documentation and measures taken to mitigate risks. Allocation of costs related to a DPIA will be: .

7. BREACH NOTIFICATION

Processor shall notify Controller without undue delay upon becoming aware of a Personal Data Breach and shall provide sufficient information to allow Controller to meet any obligations to notify the competent supervisory authority and data subjects. Notification timeframe: . Processor will document the facts surrounding the breach, its effects and remedial actions.

8. SUBPROCESSORS

Controller authorises Processor to engage Subprocessors as set forth below. Processor shall impose on each Subprocessor obligations no less protective than those in this Agreement and will remain fully liable for the performance of Subprocessors. List of authorised Subprocessors:

Controller may object to a proposed Subprocessor within of notice on reasonable grounds relating to data protection.

9. INTERNATIONAL TRANSFERS

Any transfer of Personal Data outside the European Economic Area shall occur only with appropriate safeguards as required by applicable law. Transfer mechanism or safeguards to be used: .

10. RETENTION AND DELETION

Processor shall retain Personal Data only for the time necessary to fulfil the documented instructions of Controller or as required by applicable law. Retention period: . Upon expiry of retention, Processor shall securely delete or return Personal Data at Controller's direction.

11. DATA SUBJECT RIGHTS

Processor shall, to the extent legally permitted, promptly notify Controller of any request from a Data Subject to exercise rights under applicable law (access, rectification, erasure, restriction, objection, portability). Processor will assist Controller in fulfilling such requests within .

12. RECORDS AND AUDITS

Processor shall make available to Controller all information necessary to demonstrate compliance and shall allow for and contribute to audits, including inspections, conducted by Controller or an auditor mandated by Controller subject to reasonable confidentiality obligations. Notice for audits: .

13. CONFIDENTIALITY

Processor shall ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Processor will not disclose Personal Data to any third party except as required by law or as authorised by Controller.

14. LIABILITY AND INDEMNITY

Each Party shall be liable for breach of its obligations under this Agreement under applicable law. Processor shall indemnify Controller for losses caused by Processor's breach of this Agreement, negligence, or failure to implement required technical and organizational measures except to the extent such losses are caused by Controller's instructions or breach.

15. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below:

16. AMENDMENT, WAIVER AND COUNTERPARTS

No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both Parties. No failure or delay by either Party in exercising any right shall operate as a waiver of that right. This Agreement may be executed in counterparts, each of which shall be deemed an original.

17. GOVERNING LAW, ENTIRE AGREEMENT AND SEVERABILITY

This Agreement shall be governed by and construed in accordance with the laws of: . This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements. If any provision is held invalid or unenforceable, the remaining provisions shall continue in full force and effect.

18. MISCELLANEOUS

The Parties shall each appoint a contact person responsible for data protection matters: Controller Data Protection Contact: , Processor Data Protection Contact: .

Sign Now