Global Business PIA

GLOBAL BUSINESS PRIVACY IMPACT ASSESSMENT AGREEMENT

Effective Date:

Client Name:    Client Address:

Consultant Name:    Consultant Address:

RECITALS

WHEREAS, Client operates a global business that collects, stores, and processes personal data in multiple jurisdictions and requires a privacy impact assessment to identify privacy risks and compliance measures;

WHEREAS, Consultant represents that it has the expertise, personnel, and methodologies necessary to perform a comprehensive Privacy Impact Assessment (PIA) and related advisory services for Client; and

WHEREAS, Client desires to engage Consultant, and Consultant agrees to provide such services under the terms and conditions set forth in this Agreement.

SCOPE OF WORK

Consultant shall perform a Privacy Impact Assessment and related deliverables as described below. The scope shall include identification of personal data flows, risk assessment, legal compliance mapping for applicable jurisdictions, technical and organizational security recommendations, and a written PIA report with an executive summary and remediation plan.

PAYMENT TERMS

Client agrees to pay Consultant the fees and reimbursements described in this section in consideration for the Services.

Late payments shall incur interest at % per month, compounded monthly, or the maximum permitted by applicable law, whichever is lower.

All fees are exclusive of taxes. Client shall reimburse Consultant for reasonable, pre-approved travel and out-of-pocket expenses upon submission of receipts.

TERM AND TERMINATION

This Agreement shall commence on and shall continue until , unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement for convenience upon days' prior written notice to the other party. Either party may terminate for material breach if the breaching party fails to cure such breach within 30 days following receipt of written notice specifying the breach.

Upon termination, Consultant shall deliver all work in progress and Client shall pay Consultant for Services performed and reasonable non-cancellable commitments incurred through the effective date of termination.

CONFIDENTIALITY

Each party (the Receiving Party) shall treat as Confidential Information all non-public information disclosed by the other party (the Disclosing Party) that is designated confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes business plans, data inventories, security assessments, personal data, and PIA findings.

Obligations: The Receiving Party shall (i) use the Confidential Information solely to perform its obligations under this Agreement; (ii) restrict disclosure to employees, contractors or professional advisors with a need to know and bound by confidentiality obligations no less protective than this Agreement; and (iii) implement reasonable administrative, technical, and physical safeguards to protect Confidential Information against unauthorized access or disclosure.

Exclusions: Confidential Information does not include information that (a) is or becomes publicly known without breach of this Agreement; (b) is rightfully received from a third party without confidentiality obligations; (c) is independently developed by the Receiving Party; or (d) is required to be disclosed by law or valid legal process, provided the Receiving Party gives prompt written notice to the Disclosing Party and cooperates in any effort to limit disclosure.

Survival and Remedies: The confidentiality obligations shall survive termination for a period of five (5) years, except for personal data and trade secrets which shall remain protected for as long as required by law or as necessary to protect trade secret status. Breach of confidentiality may cause irreparable harm; the Disclosing Party shall be entitled to injunctive relief in addition to any other remedies at law or in equity.

DATA PROTECTION

Where Consultant processes personal data on behalf of Client, the parties shall record the roles (Controller or Processor) applicable to each processing activity. Consultant shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk and shall assist Client with data subject rights, breach notification, and regulatory inquiries as reasonably requested.

Cross-Border Transfers: Consultant shall not transfer personal data to jurisdictions outside those agreed in writing without Client's prior written consent and, where applicable, shall use legally recognized transfer mechanisms to ensure required safeguards.

INTELLECTUAL PROPERTY

Client shall retain ownership of its pre-existing data and any personal data provided to Consultant. Consultant grants Client a perpetual, non-exclusive, worldwide license to use the deliverables for Client's internal business purposes. Consultant retains ownership of its methodologies, tools, templates and anonymized learnings which do not contain Client Confidential Information or personal data.

LIMITATION OF LIABILITY

Except for liability arising from gross negligence, willful misconduct, or breach of confidentiality, each party's aggregate liability under this Agreement shall be limited to the amount of fees paid or payable by Client to Consultant in the twelve (12) months preceding the claim. This limitation applies to all causes of action in the aggregate.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction stated below, without regard to its conflict of law rules.

ENTIRE AGREEMENT

This Agreement, including any schedules or exhibits expressly incorporated in writing, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral. Any amendment must be in writing and signed by authorized representatives of both parties.

NOTICES

All notices under this Agreement shall be in writing and delivered to the contact persons and addresses set forth below by hand, certified mail, or courier, or by email with confirmation of receipt where agreed by the parties.

Sign Now