DATA PROCESSING AGREEMENT
This Data Processing Agreement (the "DPA") is entered into as of [Effective Date] (the "Effective Date"), by and between:
[Party A], a corporation ("Processor"), and
[Party B], a corporation ("Controller").
Each may be referred to as a "Party" and together as the "Parties." This DPA forms part of the agreement governing the services (the "Main Agreement") between the Parties and applies whenever the Processor processes Personal Data on behalf of the Controller in connection with it. Where this DPA conflicts with the Main Agreement, this DPA controls in respect of the processing of Personal Data.
1. Definitions. "Personal Data", "processing", "controller", "processor", "data subject", "supervisory authority", and "personal data breach" have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR"), including as incorporated into the law of the United Kingdom. "Data Protection Laws" means all laws relating to the processing of Personal Data that apply to a Party, including the GDPR and applicable United States state privacy laws. "Personal Data" for the purposes of this DPA means personal data that the Processor processes on behalf of the Controller under the Main Agreement.
2. Details of the Processing. The Parties record the following particulars as required by Article 28(3) of the GDPR: (a) subject matter: the Processor's provision of services under the Main Agreement; (b) duration: the term of the Main Agreement, plus the period until all Personal Data is deleted or returned in accordance with this DPA; (c) nature and purpose of the processing: [description of what the processor does with the personal data]; (d) types of Personal Data: [categories of personal data to be processed]; and (e) categories of data subjects: [categories of data subjects whose personal data is processed].
3. Roles of the Parties. The Controller is the controller of the Personal Data and the Processor is its processor. The Controller is responsible for ensuring it has a lawful basis for the processing, that its instructions comply with Data Protection Laws, and that it has provided any notices and obtained any consents required from data subjects.
4. Processing on Documented Instructions. The Processor will process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do otherwise by applicable law. Where applicable law requires processing beyond the Controller's instructions, the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits it from doing so on important grounds of public interest. This DPA and the Main Agreement are the Controller's complete documented instructions at the Effective Date. The Processor will inform the Controller if, in its opinion, an instruction infringes Data Protection Laws.
5. Confidentiality of Personnel. The Processor will ensure that persons it authorizes to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to personnel who need it to provide the services.
6. Security of Processing. The Processor will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These measures include, as appropriate, pseudonymization and encryption of Personal Data, measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services, the ability to restore availability and access to Personal Data in a timely manner after an incident, and a process for regularly testing and evaluating the effectiveness of those measures.
7. Sub-processors. The Controller gives the Processor general written authorization to engage other processors ("Sub-processors") to process Personal Data. The Processor will maintain a current list of Sub-processors and will give the Controller at least 15 days' notice before adding or replacing one. If the Controller reasonably objects to a new Sub-processor on data protection grounds within that notice period, the Parties will work in good faith to find an alternative, and if none is available the Controller may terminate the affected services. The Processor will impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, and will remain fully liable to the Controller for each Sub-processor's performance.
8. Assistance with Data Subject Rights. Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests to exercise data subject rights under Chapter III of the GDPR. If the Processor receives a request directly from a data subject relating to the Controller's Personal Data, it will not respond to the substance of the request and will promptly forward it to the Controller.
9. Personal Data Breach. The Processor will notify the Controller without undue delay, and in any event within 72 hours after becoming aware of a personal data breach affecting Personal Data processed on the Controller's behalf. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and the Processor will provide further information as it becomes available.
10. Assistance with Security, Notification, and Impact Assessments. Taking into account the nature of the processing and the information available to it, the Processor will assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, including security of processing, notification of personal data breaches to supervisory authorities and data subjects, data protection impact assessments, and prior consultation with supervisory authorities.
11. Deletion or Return of Personal Data. Upon termination or expiry of the provision of services relating to processing, the Processor will, at the Controller's election, delete or return all Personal Data it processes on the Controller's behalf and delete existing copies, unless applicable law requires it to store the Personal Data. Personal Data retained in routine backups will be deleted in the ordinary course, and this DPA continues to apply to it until deletion.
12. Information and Audits. The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR, and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates. Audits may be carried out no more than once in any twelve-month period, and additionally following a personal data breach affecting the Controller's Personal Data, during business hours, subject to reasonable confidentiality and security requirements, and without unreasonably disrupting the Processor's operations. The Processor may satisfy an audit request by providing current third-party certifications or audit reports, such as ISO 27001 or SOC 2, where these reasonably address the Controller's request.
13. International Transfers. Where the Processor transfers Personal Data outside the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the Parties incorporate the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, module two (controller to processor). The Controller is the data exporter and the Processor is the data importer. Annex I.A is completed with each Party's name, address, and signatory as stated in this DPA, and with the processing activities described in the Details of the Processing. Annex I.B is completed with the subject matter, duration, nature and purpose, types of Personal Data, and categories of data subjects set out in the Details of the Processing. Transfers take place on a continuous basis as needed to provide the services, and Personal Data is retained for the duration stated there. Annex I.C: the competent supervisory authority is the authority of the EU member state where the data exporter is established, or, if the data exporter is not established in an EU member state, the Irish Data Protection Commission. Annex II is completed with these technical and organizational measures: encryption of Personal Data in transit and at rest, access controls limited to personnel who need access, logging and monitoring of that access, vulnerability management and regular testing of those measures, the ability to restore availability and access to Personal Data after an incident, and written confidentiality commitments from personnel who process Personal Data. The Parties make these selections. Clause 7 (docking clause) does not apply. The Parties select Clause 9, Option 1 (general written authorization), as further set out in the Sub-processors section of this DPA. The optional independent dispute-resolution wording in Clause 11 does not apply. For Clause 17, if the data exporter is established in an EU member state, the Parties select Option 1 and the law of that member state. If the data exporter is not established in an EU member state, the Parties select Option 2 and the law of Ireland. For Clause 18, the Parties select the courts of that same member state. Where Personal Data is transferred from the United Kingdom, the Parties also incorporate the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and in force on 21 March 2022 (the "UK Addendum"). The UK Addendum is completed as follows. Table 1: the start date is the Effective Date, and the exporter and importer are the Controller and the Processor as identified in this DPA. Table 2: the Approved EU SCCs are the clauses described above, including module two and the selections in this section. Table 3: the appendix information is Annex I.A, Annex I.B, Annex I.C, and Annex II as completed in this section. Table 4: neither Party may end the UK Addendum as set out in its Section 19. Where Personal Data is transferred from Switzerland, the clauses apply with these adaptations: the Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR are read as references to the Swiss Federal Act on Data Protection; references to the European Union, a member state, and the competent authority include Switzerland where the context requires; and data subjects in Switzerland may enforce the clauses in Switzerland. If those clauses or the UK Addendum are invalidated or withdrawn, the Parties will promptly adopt an alternative lawful transfer mechanism.
14. Liability and Relationship to the Main Agreement. Except as expressly modified by this DPA, the Main Agreement remains in full force and effect. Each Party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability set out in the Main Agreement.
15. Governing Law and Jurisdiction. This DPA is governed by the law, and subject to the jurisdiction and venue, stated in the Main Agreement, except where Data Protection Laws require otherwise.
16. General. If any provision of this DPA is held unenforceable, it will be limited to the minimum extent necessary so the rest of this DPA remains in effect. This DPA may only be amended, modified, waived, or supplemented by a writing signed by both Parties, except that the Processor may update its list of Sub-processors in accordance with this DPA. This DPA may be executed in counterparts, including electronic copies, each of which is deemed an original and which together constitute one DPA.
IN WITNESS WHEREOF, the Parties have executed this DPA as of the Effective Date.
Processor: [Party A]
By: ________________________________
Name: [Signatory]
Title: [Title]
Controller: [Party B]
By: ________________________________
Name: [Signatory]
Title: [Title]
