Legal DPA Addendum

LEGAL DPA ADDENDUM

This Data Processing Addendum ("Addendum") is entered into as of by and between Client Name: , located at (the "Controller"); and Service Provider Name: , located at (the "Processor"). The Controller and Processor are each a "Party" and together the "Parties."

RECITALS

WHEREAS, Controller has engaged Processor to provide certain services pursuant to the agreement identified as: (the "Agreement"), under which Processor will process personal data on behalf of Controller; and

WHEREAS, the Parties wish to set out terms and conditions governing the Processing of Personal Data in order to ensure compliance with applicable data protection laws; and

WHEREAS, this Addendum supplements and forms part of the Agreement and allocates responsibility between the Parties in respect of such Processing.

NOW THEREFORE, in consideration of the mutual covenants below, the Parties agree as follows:

1. DEFINITIONS

In this Addendum, the following terms shall have the meanings set forth below: "Personal Data" means any information relating to an identified or identifiable natural person processed by Processor on behalf of Controller under the Agreement. "Data Subject" means the person to whom Personal Data relates. "Processing" and "Process" have the meanings given under applicable data protection law. Other capitalized terms used but not defined herein shall have the meanings given in the Agreement.

2. SCOPE, NATURE AND PURPOSE OF PROCESSING

2.1 Nature and Purpose. Processor shall Process Personal Data for the purpose of performing the services described in the Agreement and specifically:

3. ROLES AND INSTRUCTIONS

3.1 Roles. The Parties acknowledge and agree that for the purpose of data protection law, Controller is the data controller and Processor is the data processor with respect to the Processing of Personal Data under the Agreement.

3.2 Instructions. Processor shall only Process Personal Data in accordance with Controller's documented instructions as set forth in the Agreement and this Addendum, unless otherwise required by applicable law, in which case Processor shall notify Controller of such requirement unless prohibited by law.

4. SECURITY MEASURES

4.1 Processor shall implement and maintain technical and organisational measures appropriate to the risk, including measures to ensure a level of security appropriate to the risk of Processing, taking into account the state of the art, costs of implementation and the nature, scope, context and purposes of Processing.

5. SUBPROCESSORS

5.1 Processor shall not engage a subprocessor to process Personal Data without prior written authorization from Controller. Controller grants an initial authorization for subprocessors listed below and may provide subsequent authorizations in writing.

5.2 Processor shall ensure that any subprocessor is bound by contractual terms no less protective than those in this Addendum and remains liable for the acts and omissions of such subprocessor.

6. INTERNATIONAL TRANSFERS

Processor may transfer Personal Data to jurisdictions outside the Controller's country where necessary for the performance of the Agreement, provided that appropriate safeguards consistent with applicable law are implemented to protect Personal Data.

7. DATA SUBJECT RIGHTS

Processor shall, to the extent legally permitted, promptly notify Controller of any request received from a Data Subject and shall assist Controller, taking into account the nature of the Processing, by implementing appropriate technical and organisational measures to enable Controller to respond to requests to exercise Data Subject rights.

8. BREACH NOTIFICATION

Processor shall notify Controller without undue delay after becoming aware of a personal data breach affecting Personal Data processed under the Agreement and, where feasible, provide Controller with information reasonably necessary to meet any obligations to notify supervisory authorities or Data Subjects.

9. AUDIT, INSPECTION AND RECORDS

Processor shall make available to Controller all information necessary to demonstrate compliance with obligations of this Addendum and permit and contribute to audits, inspections and reviews by Controller or an auditor mandated by Controller, subject to reasonable confidentiality protections and advance notice.

10. CONFIDENTIALITY

Processor shall ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

11. RETURN OR DELETION OF PERSONAL DATA

Upon termination or expiry of the Agreement, Processor shall, at Controller's option, return all Personal Data to Controller and delete existing copies, or securely delete or anonymize such Personal Data, unless retention is required by applicable law.

12. LIABILITY AND INDEMNITY

Each Party shall be liable for damages arising from its breach of this Addendum in accordance with applicable law and the Agreement. Processor shall indemnify Controller for losses resulting from Processor's unauthorized Processing or breach of its obligations under this Addendum, subject to the limitations of liability set forth in the Agreement.

13. TERM AND TERMINATION; SURVIVAL

This Addendum shall remain in effect for the duration of the Agreement and shall survive termination to the extent necessary to give effect to the Parties' rights and obligations arising prior to termination, and in particular obligations relating to confidentiality, return or deletion of Personal Data, and liability.

14. GOVERNING LAW

This Addendum shall be governed by and construed in accordance with the law specified in the Agreement. To the extent the Agreement does not specify governing law, the Parties agree to the law of:

15. ENTIRE AGREEMENT

This Addendum and the Agreement constitute the entire agreement between the Parties with respect to the subject matter hereof and supersede all prior agreements and understandings relating thereto.

16. SEVERABILITY

If any provision of this Addendum is held to be invalid, illegal or unenforceable, the remaining provisions shall continue in full force and effect and the Parties shall negotiate in good faith to replace the invalid provision with a valid one achieving the original intent.

17. NOTICES

Any notice required under this Addendum shall be given in writing and delivered to the address or contact specified below for each Party.

18. AMENDMENTS; WAIVER; COUNTERPARTS

Any amendment to this Addendum must be in writing and signed by authorized representatives of both Parties. No waiver of any right is effective unless in writing and signed by the Party granting the waiver. This Addendum may be executed in counterparts, each of which shall be deemed an original.

Sign Now