Legal DPA Agreement

LEGAL DPA AGREEMENT

This Data Processing Agreement ("Agreement") is entered into as of Effective Date: by and between Controller Name: located at Controller Address: and Processor Name: located at Processor Address: .

RECITALS

WHEREAS, Controller determines the purposes and means of processing personal data and engages Processor to process certain Personal Data on Controller's behalf in connection with the provision of services described in this Agreement and any underlying service agreement between the Parties (the "Services");

WHEREAS, Processor will process Personal Data only on documented instructions from Controller, in compliance with applicable data protection law and the terms of this Agreement; and

WHEREAS, the Parties wish to set forth the respective obligations with respect to the processing, security, confidentiality, transfer and return or deletion of Personal Data.

NOW, THEREFORE

In consideration of the mutual covenants contained herein and other good and valuable consideration, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person processed under this Agreement. 1.2 "Processing", "Controller", "Processor", "Sub-processor", and "Applicable Law" have the meanings given in applicable data protection legislation. 1.3 "Security Incident" means any confirmed or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed under this Agreement.

2. DETAILS OF PROCESSING

2.1 Subject matter of Processing:

2.2 Duration of Processing:

2.3 Nature and purpose of Processing:

2.4 Types of Personal Data:

2.5 Categories of Data Subjects:

3. PROCESSOR OBLIGATIONS

3.1 Processor shall process Personal Data only on documented instructions from Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by Applicable Law. Where Applicable Law requires Processor to process Personal Data other than on Controller's documented instructions, Processor shall inform Controller of that legal requirement prior to Processing, unless that law prohibits such information on important grounds of public interest.

3.2 Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Section 7, and shall ensure that any person authorized to process Personal Data is subject to a duty of confidentiality.

3.3 Processor shall assist Controller, taking into account the nature of Processing and the information available to Processor, by appropriate technical and organizational measures, insofar as this is reasonably possible, for the fulfilment of Controller's obligation to respond to requests for exercising Data Subject rights under Applicable Law.

4. CONTROLLER OBLIGATIONS

4.1 Controller shall determine the purposes and means of the Processing of Personal Data and shall ensure that its instructions to Processor comply with Applicable Law. Controller shall obtain any consents and provide any notices required by Applicable Law for the Processing of Personal Data.

5. SUB-PROCESSORS

5.1 Controller: authorizes Processor to engage Sub-processors as necessary to perform the Services: Processor may engage Sub-processors

5.2 Processor shall impose on each Sub-processor contractual obligations no less protective than those imposed on Processor under this Agreement and shall remain fully liable to Controller for the performance of the Sub-processor's obligations.

6. INTERNATIONAL TRANSFERS

6.1 Processor shall not transfer Personal Data to a jurisdiction outside the country of Controller's establishment except (i) on documented instructions from Controller, and (ii) subject to appropriate safeguards required by Applicable Law. Describe transfer mechanisms and locations:

7. SECURITY

7.1 Processor shall implement, maintain and regularly test appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access. Such measures shall include, as appropriate: pseudonymization and encryption; resilience and availability measures; ability to restore availability and access; and a process for regularly testing and evaluating the effectiveness of measures.

7.2 Describe any specific technical measures that apply:

8. SECURITY INCIDENTS

8.1 Processor shall notify Controller without undue delay and, where feasible, within 72 hours after becoming aware of a Security Incident. The notification shall describe the nature of the incident, categories and approximate number of Data Subjects and records affected, measures taken to mitigate adverse effects and contact details for further information.

8.2 Processor shall cooperate with Controller and provide reasonable assistance in any notification to supervisory authorities and Data Subjects where required by Applicable Law.

9. AUDIT AND INSPECTION

9.1 Controller or an independent auditor mandated by Controller shall have the right to audit Processor's compliance with this Agreement upon reasonable notice and subject to confidentiality obligations. Notice period for audits:

9.2 Where an on-site audit would cause disproportionate disruption, Processor may provide equivalent evidence of compliance, including certifications, reports or summaries of relevant controls.

10. RETURN OR DELETION

10.1 Upon termination or expiration of the Services, Processor shall, at Controller's choice, return all Personal Data to Controller and delete existing copies unless retention of Personal Data is required by Applicable Law. Timeframe for return or deletion:

11. LIABILITY AND INDEMNIFICATION

11.1 Each Party's liability for breaches of this Agreement shall be governed by the liability provisions of the Master Services Agreement between the Parties; where no such provision exists, Parties shall remain liable for damages resulting from breaches of Applicable Law, culpable acts, or willful misconduct. Neither Party excludes liability for death or personal injury resulting from negligence or for any liability which cannot be excluded by Applicable Law.

11.2 Processor shall indemnify and hold harmless Controller from claims arising from Processor's breach of this Agreement or breach of Applicable Law in the performance of Processing activities, subject to any limits set out in the Parties' primary agreement.

12. CONFIDENTIALITY

12.1 Processor shall treat all Personal Data and Controller's instructions as confidential information and shall not disclose such information except as necessary to perform the Services or as required by Applicable Law, and then only after giving Controller prior notice unless prohibited.

13. TERM AND TERMINATION

13.1 This Agreement shall commence on the Effective Date and continue for the duration of the Services or until terminated in accordance with the Parties' primary agreement. Termination of the primary agreement shall terminate this Agreement, subject to any obligations that survive termination to ensure proper handling of Personal Data.

14. GOVERNING LAW

14.1 This Agreement shall be governed by and construed in accordance with the laws chosen by the Parties: Governing Law: .

15. ENTIRE AGREEMENT

15.1 This Agreement, together with any referenced schedules and the primary agreement between the Parties, constitutes the entire agreement with respect to its subject matter and supersedes all prior discussions, negotiations and agreements relating to the Processing of Personal Data.

16. SEVERABILITY

16.1 If any provision of this Agreement is held to be invalid, illegal or unenforceable, that provision shall be severed and the remaining provisions shall remain in full force and effect to the maximum extent permitted by Applicable Law.

17. NOTICES

18. AMENDMENTS, WAIVER, COUNTERPARTS

18.1 Amendments to this Agreement must be in writing and signed by authorized representatives of both Parties. 18.2 No failure or delay by a Party in exercising any right shall constitute a waiver. 18.3 This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together constitute one instrument.

Sign Now