MSA Data Action Agreement

MSA Data Action Agreement

This MSA Data Action Agreement (the Agreement) is entered into as of Effective Date: by and between Client Name: whose principal place of business is and Service Provider Name: whose principal place of business is .

RECITALS

WHEREAS, the parties are parties to a Master Services Agreement dated (the MSA) under which Client engages Provider to perform certain services; and

WHEREAS, the parties desire to document and govern a specific data action to be performed by Provider on behalf of Client (the Data Action), including the nature of data involved, permitted processing activities, security controls, and obligations on breach, return or deletion of data; and

WHEREAS, this Agreement supplements and is subject to the terms of the MSA and, in the event of any inconsistency between this Agreement and the MSA with respect to the Data Action, the terms specifically addressing data protection and processing in this Agreement shall control.

NOW, THEREFORE, in consideration of the mutual covenants set forth below, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms have the meanings set forth below: "Data Action" means the specific processing activity described in Section 2; "Personal Data" means any information that identifies or can reasonably be used to identify an individual; "Processing" has the meaning given to that term under applicable data protection law; "Subprocessor" means any third party engaged by Provider to process Data on behalf of Client.

2. SCOPE OF DATA ACTION

2.1 Description of Data. The Personal Data and other information to be subject to the Data Action is described below.

3. DATA TRANSFER AND PROCESSING

3.1 Processing Instructions. Provider shall process the Data only as necessary to perform the Data Action and in accordance with Client's documented instructions. Any changes to the scope, nature or purpose of the processing shall require prior written instruction from Client.

3.2 Duration. Provider shall commence the Data Action on Start Date: and shall complete or cease processing on End Date: , unless extended by written agreement of the parties.

4. SUBPROCESSORS

4.1 Authorization. Client expressly authorizes Provider to engage Subprocessors listed below. Provider shall enter into written agreements with each Subprocessor imposing obligations at least as protective as those in this Agreement.

Provider will obtain prior written consent from Client before engaging new Subprocessors.

5. DATA SUBJECT RIGHTS AND ASSISTANCE

5.1 Assistance. Provider shall, to the extent reasonably able, assist Client in responding to requests from Data Subjects exercising rights under applicable law in relation to the Data Action.

6. SECURITY BREACHES; NOTIFICATION

6.1 Notification. Provider shall notify Client without undue delay, and in any event within Notification Period (hours): of becoming aware of any confirmed or reasonably suspected breach of security affecting the Data, including a description of the nature and scope of the breach, likely consequences and measures taken or proposed.

6.2 Cooperation. Provider shall cooperate with Client in any investigation, mitigation and regulatory reporting reasonably required by Client.

7. AUDIT RIGHTS

7.1 Right to Audit. Client or an independent auditor engaged by Client may audit Provider's compliance with the terms of this Agreement, subject to reasonable advance notice of Audit Notice Days: and in a manner that does not unreasonably disrupt Provider's operations.

8. RETURN; DELETION; DESTRUCTION

8.1 Upon expiration or termination of this Agreement or completion of the Data Action, Provider shall, at Client's election, return all Data to Client or securely delete and destroy the Data within Return Period (days): and certify such deletion upon request.

9. INDEMNIFICATION

9.1 Provider Indemnity. Provider shall indemnify, defend and hold harmless Client from and against any third-party claims, liabilities and expenses arising from Provider's breach of this Agreement or Provider's negligent or willful acts in connection with the Data Action.

9.2 Client Indemnity. Client shall indemnify, defend and hold harmless Provider from and against any third-party claims, liabilities and expenses arising from Client's instructions that result in a breach of applicable law or third-party rights.

10. LIMITATION OF LIABILITY

Except for liability arising from wilful misconduct, gross negligence, fraud, or Provider's breach of its obligations under Sections 3, 6 or 8 (as applicable), neither party's aggregate liability under this Agreement shall exceed Liability Cap: .

11. TERM; TERMINATION

This Agreement shall commence on the Effective Date and shall continue until the completion of the Data Action or until earlier terminated in accordance with the MSA. Either party may terminate this Agreement for material breach by the other party upon written notice if the breach remains uncured after Termination Cure Period (days): .

12. CONFIDENTIALITY

Each party shall maintain the confidentiality of Confidential Information disclosed under this Agreement and shall not disclose such information except as necessary to perform its obligations hereunder or as required by law, subject to prior notice to the other party where lawful and practicable.

13. MISCELLANEOUS

13.1 Notices. Any notice required or permitted under this Agreement shall be given in writing to the addresses set forth below in the Notices section and shall be effective upon receipt.

13.2 Amendments; Waiver. No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both parties. No waiver of any right shall be effective unless in writing.

13.3 Counterparts. This Agreement may be executed in counterparts, each of which shall be an original and all of which together shall constitute one instrument.

13.4 Entire Agreement. This Agreement, together with the MSA, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings relating thereto.

13.5 Severability. If any provision of this Agreement is held to be invalid, illegal or unenforceable, the remaining provisions shall continue in full force and effect and the parties shall substitute for the invalid provision a valid provision that achieves, to the extent possible, the original intent of the parties.

Sign Now