Legal PIA Form

LEGAL PRIVACY IMPACT ASSESSMENT (PIA) FORM

This Privacy Impact Assessment ("PIA") is made and entered into by and between Organization Name: ("Organization") and Data Processor Name: ("Processor") on Effective Date: .

RECITALS

WHEREAS, the Organization operates the system or service identified as System or Service Name: (the "System") which collects, processes, stores, or transmits personal data;

WHEREAS, the parties seek to document applicable data flows, identify privacy and security risks, and establish mitigations, legal bases, retention requirements, and compliance obligations with respect to the System;

WHEREAS, the parties desire to set forth responsibilities, notice procedures, and remedial measures to ensure compliance with applicable privacy law and internal policy;

NOW THEREFORE, in consideration of the mutual covenants and promises contained herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this PIA, the following terms have the meanings set forth below. "Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation or set of operations performed on Personal Data. "Data Controller" means the party that determines the purposes and means of the Processing. "Data Processor" means the party that processes Personal Data on behalf of the Data Controller.

2. SCOPE OF PROCESSING

2.1 Description of Processing: The Processor shall perform the following Processing activities on behalf of the Organization:

2.2 Categories of Personal Data: The System will collect and process the following categories of Personal Data (select all that apply and specify where applicable):

3. LEGAL BASIS AND PURPOSE

3.1 Lawful Basis: The Organization represents that the Processing is supported by the following lawful basis (identify all that apply and provide details):

3.2 Purpose Limitation: Processing shall be limited to the specific purposes described above. The Processor shall not use Personal Data for any purposes other than those documented in this PIA or otherwise instructed in writing by the Organization.

4. DATA SUBJECTS

The Personal Data relates to the following categories of data subjects:

5. RETENTION AND DELETION

5.1 Retention Period: Personal Data shall be retained only for the period necessary to fulfill the documented purposes or as required by applicable law. Retention period:

5.2 Deletion and Disposal: Upon expiration of the retention period or earlier request where permitted by law, the Processor shall delete or return Personal Data in accordance with the Organization's written instructions and shall render deleted data irrecoverable.

6. SECURITY MEASURES

6.1 Technical and organizational measures to protect Personal Data shall be implemented and maintained. The parties acknowledge the following measures (select all implemented and provide specifics where requested):

6.2 The Processor shall maintain appropriate administrative, physical and technical safeguards and promptly notify the Organization of any material changes to such safeguards.

7. RISK ASSESSMENT AND MITIGATION

7.1 Risk Identification: The parties have identified the following principal privacy risks associated with the Processing:

7.2 Mitigation Measures: For each identified risk the parties agree to the following mitigation measures and responsible parties:

8. DATA SHARING AND THIRD PARTIES

8.1 Recipients and Transfers: Personal Data may be disclosed to the following categories of recipients or transferred to the following jurisdictions:

8.2 The Processor shall ensure that any onward transfer or subprocessing is governed by written terms that provide at least the same level of protection as set forth in this PIA.

9. DATA SUBJECT RIGHTS AND REQUESTS

9.1 Request Handling: The Organization is responsible for responding to data subject requests unless otherwise agreed. The Processor shall assist the Organization in responding to requests in a timely manner and shall notify the Organization promptly upon receipt of any request directed to the Processor. Data subject request contact:

10. AUDIT, COMPLIANCE AND RECORDKEEPING

10.1 Audit Rights: The Organization shall have the right to audit compliance with the obligations set forth in this PIA, subject to reasonable notice and confidentiality protections. The Processor shall maintain records sufficient to demonstrate compliance and shall provide such records to the Organization upon reasonable request.

10.2 Documentation: The Processor shall maintain accurate records of Processing activities and shall cooperate with regulatory inquiries and supervisory authorities where required by law.

11. BREACH NOTIFICATION

11.1 Notification Obligations: In the event of a confirmed personal data breach, the Processor shall notify the Organization without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification shall include a description of the nature of the breach, categories of affected data, likely consequences, and measures taken or proposed to address the breach.

12. NOTICES

12.1 Delivery: Any notice required or permitted under this PIA shall be given in writing and delivered to the addresses set forth below or such other addresses as may be designated in writing by the parties.

13. AMENDMENTS AND MODIFICATIONS

This PIA may be amended only by a written instrument signed by both parties. Any amendment that materially increases the scope of Processing or reduces the level of protection afforded to Personal Data shall require the express prior written consent of the Organization.

14. WAIVER

The failure of either party to enforce any provision of this PIA shall not constitute a waiver of future enforcement of that or any other provision.

15. GOVERNING LAW

This PIA shall be governed by and construed in accordance with the laws of the jurisdiction specified here: , without regard to conflict-of-law principles.

16. ENTIRE AGREEMENT

This PIA, together with any appendices and written instructions referenced herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior or contemporaneous agreements, understandings, and communications relating to such subject matter.

17. SEVERABILITY

If any provision of this PIA is held to be invalid, illegal, or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired.

18. COUNTERPARTS AND EXECUTION

This PIA may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Execution by electronic signature or scanned copy shall be binding.

Sign Now