Legal Data Processing Instructions

LEGAL DATA PROCESSING INSTRUCTIONS

This Legal Data Processing Instructions (the "Instructions") is entered into as of Effective Date: , by and between Controller Name: ("Controller") and Processor Name: ("Processor").

RECITALS

WHEREAS, Controller and Processor are parties to a primary data processing agreement or other master agreement referenced as Agreement Reference: (the "Agreement");

WHEREAS, Controller requires Processor to process Personal Data in accordance with documented instructions and applicable data protection law; and

WHEREAS, the parties desire to set forth the specific operational, technical and organizational instructions for the Processing of Personal Data under the Agreement.

NOW THEREFORE, in consideration of the mutual covenants contained herein, the parties agree as follows:

1. DEFINITIONS

1.1 For purposes of these Instructions, capitalized terms not otherwise defined herein have the meanings set forth in the Agreement. "Personal Data" means any information relating to an identified or identifiable natural person processed by Processor on behalf of Controller. "Processing" and "Sub-processor" shall be interpreted consistent with applicable data protection law.

2. INSTRUCTIONS FOR PROCESSING

2.1 Processor shall process Personal Data only on documented instructions from Controller, including these Instructions, for the specific purposes set forth in Section 3. Any additional processing not described in these Instructions is prohibited unless Controller provides prior written instructions.

3. PURPOSE AND SCOPE

3.1 Purpose. The Personal Data shall be processed for the following purposes:

4. DURATION

4.1 The Processor shall process Personal Data for the period necessary to achieve the Purpose or until the Agreement is lawfully terminated. Unless otherwise instructed in writing by Controller, Processor will continue processing until termination.

4.2 Optional contract end date (if applicable):

5. SECURITY MEASURES

5.1 Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures listed below. Processor shall provide documentation of such measures upon reasonable request.

Encryption at rest

Encryption in transit (TLS or equivalent)

Role-based access controls and least privilege

Audit logging and continuous monitoring

Pseudonymization or tokenization where feasible

6. SUB-PROCESSORS

6.1 Processor shall not engage any Sub-processor without Controller's prior written consent. Controller's consent may be given in writing or by electronic confirmation to the extent permitted by the Agreement.

7. INTERNATIONAL TRANSFERS

7.1 Any international transfer of Personal Data shall be carried out only on the basis of an appropriate transfer mechanism permitted under applicable data protection law.

Standard contractual clauses or equivalent

Binding corporate rules

Adequacy decision or similar lawful basis

8. DATA SUBJECT RIGHTS

8.1 Processor shall promptly notify Controller if it receives a request from a data subject to exercise rights under applicable law and shall not respond to such request except on Controller's documented instructions or as required by law.

9. BREACH NOTIFICATION

9.1 Processor shall notify Controller without undue delay and, where feasible, within hours after becoming aware of a Personal Data breach affecting Controller's Personal Data. Notification shall include details reasonably necessary to enable Controller to meet its obligations under applicable law.

10. RETURN AND DELETION

10.1 Upon termination or expiry of the Agreement, Processor shall, at Controller's choice, return all Personal Data to Controller and delete existing copies, or securely destroy such Personal Data, unless retention is required by applicable law. If retention is required, Processor shall isolate and protect the Personal Data against further processing.

10.2 Controller's instruction on return or deletion (choose one): Return Delete/Destroy

11. AUDIT AND INSPECTION

11.1 Controller or an independent auditor mandated by Controller shall have the right to perform audits and inspections, subject to reasonable notice and confidentiality obligations, to verify Processor's compliance with these Instructions. Processor shall provide reasonable cooperation and access to relevant information.

12. LEGAL OBLIGATIONS

12.1 If Processor is required by law to process Personal Data in a manner inconsistent with Controller's instructions, Processor shall promptly inform Controller of the legal requirement unless prohibited by law from doing so, and shall cooperate with Controller to seek a protective order or other appropriate remedy.

13. LIABILITY

13.1 Each party shall be liable for breaches of this Instruction to the extent provided in the Agreement. Processor shall indemnify Controller for losses resulting from Processor's breach of its obligations under these Instructions, including unauthorized disclosure or loss of Personal Data caused by Processor's failure to implement required measures.

14. GOVERNING LAW

14.1 These Instructions shall be governed by and construed in accordance with the laws of:

15. ENTIRE AGREEMENT; SEVERABILITY; AMENDMENTS; WAIVER; COUNTERPARTS; NOTICES

15.1 Entire Agreement. These Instructions, together with the Agreement, constitute the entire understanding between the parties with respect to the subject matter herein and supersede all prior instructions and agreements with respect to such subject matter.

15.2 Severability. If any provision of these Instructions is held invalid or unenforceable, the remainder shall continue in full force and effect.

15.3 Amendments and Waiver. Any amendment or waiver of any provision of these Instructions must be in writing and signed by both parties. A failure or delay to exercise any right is not a waiver of that right.

15.4 Counterparts. These Instructions may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

IN WITNESS WHEREOF, the parties have executed these Legal Data Processing Instructions as of the Effective Date set forth above.

Sign Now