DATA PROCESSING AGREEMENT
This Data Processing Agreement (the "Agreement") is entered into as of [Effective Date] (the "Effective Date"), by and between:
[Party A], a corporation ("Processor"), and
[Party B], a corporation ("Controller").
This Data Processing Agreement (this "DPA") forms part of the Main Agreement between the Parties and applies whenever the Processor processes Personal Data on behalf of the Controller in connection with it. Where this DPA conflicts with the Main Agreement, this DPA controls in respect of the processing of Personal Data.
1. Definitions. "Personal Data", "processing", "controller", "processor", "data subject", "supervisory authority", and "personal data breach" have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR"), including as incorporated into the law of the United Kingdom. "Data Protection Laws" means all laws relating to the processing of Personal Data that apply to a Party, including the GDPR and applicable United States state privacy laws. "Personal Data" for the purposes of this DPA means personal data that the Processor processes on behalf of the Controller under the Main Agreement.
2. Details of the Processing. The Parties record the following particulars as required by Article 28(3) of the GDPR: (a) subject matter: the Processor's provision of services under the Main Agreement; (b) duration: the term of the Main Agreement, plus the period until all Personal Data is deleted or returned in accordance with this DPA; (c) nature and purpose of the processing: [nature and purpose of the processing]; (d) types of Personal Data: [categories of personal data to be processed]; and (e) categories of data subjects: [categories of data subjects whose personal data is processed].
3. Roles of the Parties. The Controller is the controller of the Personal Data and the Processor is its processor. The Controller is responsible for ensuring it has a lawful basis for the processing, that its instructions comply with Data Protection Laws, and that it has provided any notices and obtained any consents required from data subjects.
4. Processing on Documented Instructions. The Processor will process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do otherwise by applicable law. Where applicable law requires processing beyond the Controller's instructions, the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits it from doing so on important grounds of public interest. This DPA and the Main Agreement are the Controller's complete documented instructions at the Effective Date. The Processor will inform the Controller if, in its opinion, an instruction infringes Data Protection Laws.
5. Confidentiality of Personnel. The Processor will ensure that persons it authorises to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to personnel who need it to provide the services.
6. Security of Processing. The Processor will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These measures include, as appropriate, pseudonymisation and encryption of Personal Data, measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services, the ability to restore availability and access to Personal Data in a timely manner after an incident, and a process for regularly testing and evaluating the effectiveness of those measures.
7. Sub-processors. The Controller gives the Processor general written authorisation to engage other processors ("Sub-processors") to process Personal Data. The Processor will maintain a current list of Sub-processors and will give the Controller at least 15 days' notice before adding or replacing one. If the Controller reasonably objects to a new Sub-processor on data protection grounds within that notice period, the Parties will work in good faith to find an alternative, and if none is available the Controller may terminate the affected services. The Processor will impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, and remains fully liable to the Controller for each Sub-processor's performance.
8. Assistance with Data Subject Rights. Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests to exercise data subject rights under Chapter III of the GDPR. If the Processor receives a request directly from a data subject relating to the Controller's Personal Data, it will not respond to the substance of the request and will promptly forward it to the Controller.
9. Personal Data Breach. The Processor will notify the Controller without undue delay, and in any event within 72 hours after becoming aware of a personal data breach affecting Personal Data processed on the Controller's behalf. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and the Processor will provide further information as it becomes available.
10. Assistance with Security, Notification, and Impact Assessments. Taking into account the nature of the processing and the information available to it, the Processor will assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, including security of processing, notification of personal data breaches to supervisory authorities and data subjects, data protection impact assessments, and prior consultation with supervisory authorities.
11. Deletion or Return of Personal Data. On the end of the provision of services relating to processing, the Processor will at the Controller's election, delete or return all Personal Data it processes on the Controller's behalf and delete existing copies, unless applicable law requires it to store the Personal Data. Personal Data retained in routine backups will be deleted in the ordinary course, and this DPA continues to apply to it until deletion.
12. Information and Audits. The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR, and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates. Audits may be carried out no more than once in any twelve month period, and additionally following a Personal Data Breach affecting the Controller's Personal Data, during business hours, subject to reasonable confidentiality and security requirements, and without unreasonably disrupting the Processor's operations. The Processor may satisfy an audit request by providing current third party certifications or audit reports, such as ISO 27001 or SOC 2, where these reasonably address the Controller's request.
13. International Transfers. Where the Processor transfers Personal Data outside the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the Parties incorporate by reference the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, module two (controller to processor), completed with the details of processing set out in this DPA, together with the UK International Data Transfer Addendum where UK data is transferred. If those clauses are invalidated or withdrawn, the Parties will promptly adopt an alternative lawful transfer mechanism.
14. Liability and Relationship to the Main Agreement. Except as expressly modified by this DPA, the Main Agreement remains in full force and effect. Each Party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability set out in the Main Agreement.
15. Governing Law and Jurisdiction. This DPA is governed by the law, and subject to the jurisdiction and venue, stated in the Main Agreement, except where Data Protection Laws require otherwise.
16. General. If any provision of this DPA is held unenforceable, it will be limited to the minimum extent necessary so the rest of this DPA remains in effect. This DPA may only be amended, modified, waived, or supplemented by a writing signed by both Parties, except that the Processor may update its list of Sub-processors in accordance with this DPA. This DPA may be executed in counterparts, including electronic copies, each of which is deemed an original and which together form the same agreement.
IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.
Processor: [Party A]
By: ________________________________
Name: [Signatory]
Title: [Title]
Controller: [Party B]
By: ________________________________
Name: [Signatory]
Title: [Title]
