PIPEDA Compliance Form

PIPEDA Compliance Form

This PIPEDA Compliance Form (the "Form") is made on this day of , , between Disclosing Organization: with principal address (the "Disclosing Party"), and Receiving Party: with principal address (the "Receiving Party").

RECITALS

WHEREAS the Disclosing Party collects, holds and uses personal information in the course of its business and seeks to disclose certain categories of personal information to the Receiving Party for the limited purposes described herein;

WHEREAS the Receiving Party will process personal information on behalf of the Disclosing Party and will implement reasonable safeguards and policies to protect such personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law;

WHEREAS the parties wish to set out their respective obligations, representations and procedures with respect to collection, use, disclosure, retention, safeguarding and disposition of personal information exchanged between them.

NOW THEREFORE, in consideration of the mutual covenants and agreements set forth below, the parties agree as follows:

1. DEFINITIONS

1.1 "Personal Information" means any information about an identifiable individual, including but not limited to name, contact information, identifiers, financial information, and any special categories of information as defined under PIPEDA.

1.2 "Processing" or "process" means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, use, disclosure, storage, erasure and destruction.

2. SCOPE OF PROCESSING

2.1 The Receiving Party shall process only the categories of Personal Information described below and only for the purposes expressly authorized by the Disclosing Party:

3. LAWFUL BASIS AND CONSENT

3.1 The Disclosing Party represents that, to the best of its knowledge, it has obtained all consents, notices and legal authorities necessary to permit the collection, use and disclosure of Personal Information to the Receiving Party for the purposes set out in this Form. The Receiving Party shall not process Personal Information for any other purpose without prior written authorization.

3.2 The Receiving Party shall promptly notify the Disclosing Party if it determines that the processing is or will become unlawful or if it receives a complaint, inquiry or request from an individual concerning the Personal Information.

4. SAFEGUARDS AND SECURITY

4.1 The Receiving Party shall implement and maintain appropriate technical, administrative and physical safeguards designed to protect Personal Information against loss, unauthorized access, disclosure, copying, use or modification, taking into account the sensitivity of the information and the state of technological development.

5. ACCESS, ACCURACY, RETENTION AND DESTRUCTION

5.1 The Receiving Party shall, upon request and subject to applicable law, assist the Disclosing Party in responding to access and correction requests received from individuals and shall not deny any access or correction request absent lawful basis.

6. BREACH NOTIFICATION AND INCIDENT RESPONSE

6.1 The Receiving Party shall notify the Disclosing Party of any unauthorized access, loss or disclosure of Personal Information (a "Security Breach") as soon as reasonably practicable and, in any event, no later than 72 hours after discovery of the Security Breach. Notification shall include a description of the circumstances, categories of affected Personal Information, remedial steps taken and recommended steps for affected individuals.

7. AUDIT AND COMPLIANCE

7.1 The Receiving Party shall maintain records of processing activities and shall permit the Disclosing Party, or an independent auditor engaged by the Disclosing Party, to reasonably audit compliance with this Form upon prior written notice. Audits shall be conducted during normal business hours and without undue disruption.

8. CROSS-BORDER TRANSFERS

8.1 The Receiving Party shall not transfer Personal Information to any jurisdiction outside of Canada unless (a) authorized by the Disclosing Party in writing, and (b) appropriate safeguards are in place to ensure a comparable level of protection to that required by PIPEDA.

9. THIRD PARTIES AND SUBPROCESSORS

9.1 The Receiving Party shall not engage any third party to process Personal Information without prior written consent of the Disclosing Party. Where permitted, the Receiving Party shall impose contractual obligations on subcontractors that are no less protective than those set out in this Form.

10. REPRESENTATIONS, WARRANTIES AND INDEMNITY

10.1 Each party represents and warrants that it has the full power and authority to enter into this Form and that performance of its obligations will not violate any law or agreement.

10.2 The Receiving Party shall indemnify, defend and hold harmless the Disclosing Party from and against any third party claims, liabilities, losses, damages, costs and expenses arising out of the Receiving Party's breach of this Form, including unauthorized disclosure or misuse of Personal Information, except to the extent caused by the Disclosing Party's negligence or willful misconduct.

11. LIMITATION OF LIABILITY

11.1 Except for breaches of confidentiality and indemnity obligations, neither party shall be liable to the other for indirect, special, incidental or consequential damages arising out of this Form. The aggregate liability of either party for direct damages shall not exceed the amounts paid or payable under the underlying commercial agreement between the parties during the twelve (12) month period preceding the claim, except to the extent such limitation is prohibited by applicable law.

12. TERM AND TERMINATION

12.1 This Form shall commence on the effective date set forth above and remain in effect for the term of the parties' business relationship unless earlier terminated in accordance with this Section.

12.2 Upon termination or expiry, the Receiving Party shall, at the election of the Disclosing Party, return or securely destroy all Personal Information and certify in writing that such return or destruction has been completed, except to the extent retention is required by law.

13. NOTICES

13.1 All notices required or permitted under this Form shall be in writing and delivered to the addresses set forth below or to such other address as a party may designate by written notice. Notices shall be deemed given when delivered personally, sent by prepaid registered mail, or sent by overnight courier.

14. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

14.1 This Form shall be governed by and construed in accordance with the laws of the Province of and the federal laws of Canada applicable therein, including applicable provisions of PIPEDA.

14.2 This Form constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous communications, representations and agreements, whether oral or written.

14.3 If any provision of this Form is found to be invalid, illegal or unenforceable, the remaining provisions shall remain in full force and effect, and the parties shall negotiate in good faith to replace the invalid provision with a valid provision that achieves, to the extent possible, the original intent and economic effect.

15. AMENDMENTS; WAIVER; COUNTERPARTS

15.1 No amendment or modification of this Form shall be effective unless made in writing and signed by authorized representatives of both parties.

15.2 Failure or delay by either party to exercise any right or remedy under this Form shall not operate as a waiver of such right or remedy.

15.3 This Form may be executed in counterparts and delivered by electronic transmission, each of which shall be deemed an original and all of which together shall constitute one instrument.

ADDITIONAL PROVISIONS

Sign Now