GDPR Compliance Statement

GDPR Compliance Statement

This GDPR Compliance Statement is entered into as of Effective Date: by and between Controller Name: with registered address: and Processor Name: with registered address: (each a "Party" and together the "Parties").

RECITALS

WHEREAS, Controller determines the purposes and means of Processing of Personal Data and seeks assurances that Processing activities will comply with applicable data protection obligations, including but not limited to the General Data Protection Regulation relating to the protection of natural persons with regard to the Processing of Personal Data; and

WHEREAS, Processor provides services to Controller which necessarily involve access to or Processing of Personal Data on behalf of Controller and will implement and maintain appropriate technical and organizational measures to protect such Personal Data; and

WHEREAS, the Parties desire to set forth their respective roles, responsibilities and commitments to ensure that Processing is performed in accordance with applicable data protection law.

NOW THEREFORE, in consideration of the mutual covenants herein, the Parties agree as follows:

1. DEFINITIONS

1.1. "Personal Data" means any information relating to an identified or identifiable natural person that is provided to Processor or accessed by Processor in connection with the services described in this Statement.

1.2. "Processing" and related terms shall have the meanings given in applicable data protection law.

2. SCOPE AND PURPOSE OF PROCESSING

2.1. Processor shall Process Personal Data only for the specific documented purposes described as:

2.2. The categories of data subjects and categories of Personal Data to be Processed are set out as follows:

3. TECHNICAL AND ORGANIZATIONAL MEASURES

3.1. Processor represents that it has implemented and will maintain appropriate technical and organizational measures appropriate to the risk, including measures to ensure ongoing confidentiality, integrity, availability and resilience of Processing systems and services.

3.2. The Parties acknowledge that Processor's security measures shall include, at a minimum, the following categories. Processor shall mark each item below to confirm implementation:

Access control and authentication mechanisms (logical access restrictions, MFA where applicable)

Encryption of data at rest and in transit where feasible

Pseudonymisation and minimisation procedures

Documented incident response and breach notification procedures

4. DATA SUBJECT RIGHTS

4.1. Processor shall assist Controller, taking into account the nature of Processing and available information, by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligation to respond to requests from data subjects exercising their rights under applicable data protection law.

4.2. Processor shall promptly notify Controller if it receives a request from a data subject relating to Personal Data and shall not respond to such request except on Controller's documented instructions or as required by applicable law.

5. SUB-PROCESSING

5.1. Processor shall not engage another processor (sub-processor) without prior written authorization from Controller. Where authorized, Processor shall ensure by contract that the sub-processor is subject to obligations at least equivalent to those imposed on Processor under this Statement.

6. INTERNATIONAL TRANSFERS

6.1. Processor shall not transfer Personal Data outside the European Economic Area or to any country that does not ensure an adequate level of protection, except on the basis of appropriate safeguards permitted by applicable law and with Controller's prior written authorization. Any permitted transfers shall be documented and Controller will be informed of the destination jurisdictions.

7. SECURITY INCIDENTS AND BREACH NOTIFICATION

7.1. Processor shall notify Controller without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach affecting Controller's Personal Data. Such notification shall include, to the extent possible, a description of the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences and measures taken or proposed.

8. AUDITS AND RECORDS

8.1. Processor shall maintain records of Processing activities and shall, upon reasonable request and subject to confidentiality restrictions, make available to Controller evidence of compliance with this Statement, including audit reports or certifications. Controller may, subject to reasonable notice and during normal business hours, conduct audits or inspections where such audits are necessary to verify compliance.

9. RETENTION AND DELETION

9.1. Processor shall retain Personal Data only for the period necessary to fulfill the documented purposes or as required by law. Upon termination or expiry of the relationship, Processor shall, at Controller's choice, return or securely delete Personal Data and certify deletion where feasible.

10. CONFIDENTIALITY

10.1. Processor shall ensure that all personnel authorized to Process Personal Data are under appropriate confidentiality obligations and have received suitable privacy and security training.

11. LIABILITY AND INDEMNIFICATION

11.1. Each Party shall be liable for breaches of this Statement to the extent caused by its own acts or omissions. Processor shall indemnify Controller for direct losses resulting from Processor's material breach of this Statement, including failure to implement appropriate technical and organizational measures, subject to any limitations agreed in the parties' main services agreement.

12. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

12.1. This Statement shall be governed by the laws of the jurisdiction specified by Controller: .

12.2. This Statement constitutes the entire agreement between the Parties with respect to the subject matter herein and supersedes prior writings and understandings relating to GDPR compliance commitments. Any amendment must be in writing and signed by authorized representatives of both Parties.

12.3. If any provision of this Statement is held invalid or unenforceable, the remainder of this Statement shall remain in full force and effect and the invalid or unenforceable provision shall be replaced by a valid provision that most closely reflects the Parties' original intent.

13. NOTICES; AMENDMENTS; COUNTERPARTS

13.1. Notices under this Statement shall be given in writing to the contact details set forth below. Amendments shall be effective only if documented in writing and signed by both Parties. This Statement may be executed in counterparts, each of which shall constitute an original and all of which together shall constitute one agreement.

CERTIFICATION

Each Party certifies that the information provided in and attached to this Statement is true, complete and accurate to the best of its knowledge and that it will comply with the obligations set forth herein. The undersigned persons warrant that they are authorized to execute this Statement on behalf of the Party for whom they sign.

Sign Now