Legal Data Retention Declaration

Legal Data Retention Declaration

This Legal Data Retention Declaration ("Declaration") is made and entered into by and between Client Name: , with principal address at , and Service Provider Name: , with principal address at . Effective Date: .

RECITALS

WHEREAS, Client collects, processes and stores certain categories of data that may include personal data, transactional records, metadata, and other information necessary for the provision of services described in the parties' operative agreement; and

WHEREAS, Provider performs data processing, storage, backup, or other information technology services on behalf of Client and will, in the course of performance, have access to or control over some or all of Client's data; and

WHEREAS, the parties desire to set forth binding retention, archival, deletion and compliance obligations with respect to retained data to ensure legal, regulatory and contractual obligations are satisfied.

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth below, and intending to be legally bound, the parties agree as follows:

1. DEFINITIONS

1.1 "Retained Data" means all data types, records and information provided to or created by Provider in the performance of services under the operative agreement, including but not limited to personal data, business records, logs, backups and derivative data.

1.2 "Retention Period" means the period during which Retained Data must be maintained by Provider as required by this Declaration or applicable law.

2. SCOPE OF RETENTION

2.1 Provider shall retain Retained Data only for as long as necessary to fulfill the documented business purposes set forth in this Declaration or the operative agreement, or to satisfy retention obligations under applicable law.

2.2 Provider will not use or retain any categories of Retained Data for purposes incompatible with Client's instructions, except to the extent required by mandatory law, in which case Provider shall notify Client to the extent permitted by law.

3. RETENTION SCHEDULE

The parties hereby agree the following initial retention schedule shall apply to the identified categories of Retained Data. The schedule may be amended in writing pursuant to the Amendments clause.

4. SECURITY AND ACCESS

4.1 Provider shall implement and maintain administrative, technical and physical safeguards appropriate to the sensitivity of the Retained Data and consistent with industry standards to protect against unauthorized access, disclosure, alteration or destruction.

4.2 Provider shall restrict access to Retained Data to personnel who have a documented need to access such data for performance of their duties and shall maintain records of access for audit purposes.

5. DATA SUBJECT RIGHTS AND REMEDIATION

5.1 Provider shall cooperate with Client to the extent reasonably necessary to enable Client to respond to lawful requests from data subjects, regulators or other authorized third parties regarding access, correction, deletion or portability of Retained Data.

5.2 Where deletion is required under applicable law or this Declaration, Provider shall securely delete or render inaccessible the affected Retained Data in accordance with documented procedures and shall, upon Client's request, certify in writing that deletion has been completed.

6. AUDIT, COMPLIANCE AND RECORDKEEPING

6.1 Provider shall maintain adequate records demonstrating compliance with this Declaration, including retention logs and deletion certificates, and shall permit Client or its authorized auditor to review such records upon reasonable notice, subject to confidentiality protections.

7. SECURITY INCIDENTS AND BREACH NOTIFICATION

7.1 Provider shall notify Client without undue delay upon becoming aware of any Security Incident affecting Retained Data. Notification shall include the nature of the incident, categories of data affected, likely consequences and measures taken or proposed to address the incident.

7.2 Provider shall cooperate with Client in any regulatory reporting obligations, remediation measures and follow-up investigations resulting from a Security Incident.

8. CONFIDENTIALITY; LIMITATION ON USE

8.1 All Retained Data shall be treated as Confidential Information. Provider shall not disclose, sell, license or otherwise make Retained Data available to any third party except as expressly permitted in writing by Client or as required by law.

9. RETURN OR DESTRUCTION OF DATA

9.1 Upon expiration or termination of the operative agreement, or upon expiration of the applicable Retention Period, Provider shall, at Client's election, return Retained Data to Client in a mutually agreed format or securely destroy such data and certify in writing that destruction has been completed, except to the extent retention is required by applicable law.

10. INDEMNITY

10.1 Provider shall indemnify, defend and hold harmless Client from and against any third-party claims, liabilities, fines or expenses arising from Provider's breach of this Declaration, including failure to comply with retention or deletion obligations, except to the extent such loss results from Client's instructions or acts.

11. TERM, TERMINATION AND SURVIVAL

11.1 This Declaration shall commence on the Effective Date and shall survive termination of the operative agreement to the extent necessary to complete retention, deletion, audit and remediation obligations herein. Provisions that by their nature should survive termination shall so survive.

12. NOTICES

All notices, requests and other communications required or permitted under this Declaration shall be in writing and shall be delivered to the addresses set forth below or to such other address as a party may designate in writing.

13. AMENDMENTS; WAIVER; COUNTERPARTS

13.1 No amendment to this Declaration shall be effective unless in writing and executed by authorized representatives of both parties. Failure to enforce any provision shall not constitute a waiver of that provision.

13.2 This Declaration may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

14. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

14.1 This Declaration shall be governed by and construed in accordance with the laws chosen by the parties: Governing Jurisdiction: , without regard to choice-of-law principles.

14.2 If any provision of this Declaration is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. This Declaration constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings relating to the same.

15. REPRESENTATIONS AND CERTIFICATIONS

Each party represents and warrants that it has the full power and authority to enter into this Declaration, that the obligations herein are legal, valid and binding, and that the signatory below is authorized to execute this Declaration on the party's behalf.

Sign Now