Legal Processing Activities Form

LEGAL PROCESSING ACTIVITIES FORM

This Legal Processing Activities Form (the Agreement) is entered into between Client Name: and Processor Name: with Effectiveness Date: .

RECITALS

WHEREAS, Client is subject to obligations under applicable data protection and privacy laws and requires Processor to perform certain processing activities on Client's behalf; and

WHEREAS, Processor has the technical and organizational capabilities to perform such processing in accordance with Client's instructions and the obligations set forth herein; and

WHEREAS, the parties desire to document the scope, purposes and safeguards for the Processing Activities described below.

NOW, THEREFORE

In consideration of the mutual covenants contained in this Agreement, the parties agree as follows.

1. DEFINITIONS

For purposes of this Agreement, the following definitions apply: "Personal Data" means any information relating to an identified or identifiable natural person processed under this Agreement. "Processing" means any operation or set of operations performed on Personal Data. "Applicable Law" means laws and regulations applicable to processing of Personal Data under this Agreement.

2. SCOPE AND PURPOSE OF PROCESSING

2.1 Purpose: Processor shall process Personal Data only for the following documented purposes:

2.2 Activities: The specific processing activities to be performed include collection, storage, retrieval, analysis, and transmission of records as necessary to deliver the Services described above and in any appended statement of work.

3. CATEGORIES OF DATA AND DATA SUBJECTS

3.1 Categories of Personal Data processed (check all that apply and add detail where required):

Identifiers (names, national identifiers)

Contact information (email, phone, postal address)

Financial data (banking, payment details)

Special categories / sensitive data

3.2 Data Subjects: The Personal Data relates to the following categories of data subjects (e.g., employees, customers, vendors):

4. LAWFUL BASIS

Processor warrants that it will only process Personal Data in accordance with Client's documented instructions and under a lawful basis for processing under Applicable Law. Parties confirm the lawful basis for processing as:

5. SECURITY AND CONFIDENTIALITY

5.1 Security Measures: Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Minimum measures include:

5.2 Confidentiality: Processor shall ensure personnel authorized to process Personal Data are subject to confidentiality obligations and shall restrict access to Personal Data to those personnel with a need to know.

6. SUBPROCESSORS AND THIRD‑PARTY TRANSFERS

6.1 Subprocessors: Client authorizes Processor to engage subprocessors to carry out processing activities, provided Processor enters into written agreements imposing substantially the same data protection obligations as set forth herein. List current subprocessors and locations:

6.2 International Transfers: Processor may transfer Personal Data to jurisdictions outside the country of origin only where adequate safeguards exist or as permitted by Applicable Law. Describe transfer destinations and safeguards:

7. DATA SUBJECT RIGHTS

Processor shall, to the extent permitted by Applicable Law, promptly notify Client of any request from a data subject to exercise rights with respect to Personal Data. Processor will assist Client in responding to such requests in accordance with Client's instructions and Applicable Law.

8. BREACH NOTIFICATION

Processor will notify Client without undue delay, and in any event within the time period required by Applicable Law, after becoming aware of a personal data breach affecting Personal Data processed under this Agreement. Notification shall include a description of the nature and scope of the breach, categories and approximate number of affected data subjects and records, and remedial measures taken.

9. RETENTION, RETURN AND DELETION

Processor shall retain Personal Data only for the period necessary to perform the Services or as required by Applicable Law. Upon termination or expiry of this Agreement, Processor will, at Client's direction, return or securely delete Personal Data and certify such deletion upon request.

10. AUDIT, RECORDS AND COMPLIANCE

Client or an independent auditor appointed by Client shall have the right to audit Processor's compliance with this Agreement, subject to reasonable notice and confidentiality protections. Processor will maintain records of processing activities and make them available for inspection to demonstrate compliance.

11. LIABILITY AND INDEMNITY

Each party's liability for direct damages arising from breach of this Agreement shall be subject to the monetary limitations and exclusions agreed between the parties in the principal services agreement. Each party shall indemnify the other against losses resulting from its own breach of Applicable Law or willful misconduct in connection with processing Personal Data.

12. NOTICES

13. AMENDMENTS, WAIVER, COUNTERPARTS

Any amendment to this Agreement must be in writing and executed by authorized representatives of both parties. No failure or delay by either party in exercising any right shall constitute a waiver. This Agreement may be executed in counterparts, each of which shall constitute an original and all of which shall constitute one instrument.

14. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

This Agreement shall be governed by the laws specified by the parties below without regard to conflict of law principles. If any provision is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. This Agreement, together with any referenced statements of work or appendices, constitutes the entire agreement between the parties with respect to the subject matter herein and supersedes prior agreements.

15. MISCELLANEOUS

15.1 Survival: Provisions of this Agreement that by their nature should survive termination shall survive, including but not limited to confidentiality, indemnity, and data return/deletion obligations.

15.2 Relationship of the Parties: The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, or agency relationship for any purpose.

SIGNATURES

Sign Now