data processing agreement

Data Processing Addendum

Instructions for Use

• Fill in the bracketed information throughout the document to reflect the specific identities and roles of the Controller and Processor.
• Review the "Technical and Organizational Measures" section in the Annex to ensure it accurately describes your actual security practices.
• Once completed, have an authorized representative from both organizations sign and date the document to execute the agreement.

1. Parties and Definitions

This Data Processing Addendum (the "Addendum") is entered into by and between:

Controller: [Controller Company Name], with its principal place of business at [Controller Address] ("Controller").

Processor: [Processor Company Name], with its principal place of business at [Processor Address] ("Processor").

Definitions:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Applicable Data Protection Laws" means all laws and regulations, including the GDPR, CCPA, or other relevant privacy legislation, applicable to the processing of Personal Data under the Agreement.
• "Services" refers to the primary agreement or services provided by Processor to Controller, dated [Date of Master Agreement].

2. Processing of Personal Data

2.1 Scope and Purpose: The Processor shall process Personal Data only for the purpose of providing the Services as defined in the Master Agreement and in accordance with the documented instructions of the Controller. 2.2 Compliance: Both parties shall comply with their respective obligations under Applicable Data Protection Laws. 2.3 Duration: This Addendum shall remain in effect for the duration of the Master Agreement and thereafter until all Personal Data is deleted or returned to the Controller.

3. Obligations of the Processor

3.1 Confidentiality: Processor shall ensure that its personnel authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 3.2 Security: Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, pseudonymization, and measures to ensure ongoing confidentiality and integrity. 3.3 Sub-processors: Processor shall not engage any third-party sub-processor without prior written authorization from the Controller. Processor shall remain fully liable for the acts and omissions of its sub-processors. 3.4 Data Subject Rights: Processor shall provide reasonable assistance to the Controller in fulfilling obligations to respond to requests for exercising data subject rights. 3.5 Breach Notification: Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.

4. Audit and Inspection

Upon reasonable notice, the Processor shall make available to the Controller all information necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

5. Deletion or Return of Data

Upon termination of the Services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies, unless applicable law requires storage of the Personal Data.

6. Governing Law

This Addendum shall be governed by and construed in accordance with the laws of [Jurisdiction/State/Country].

Signature & Acknowledgment

For Controller: Signature: __________ Printed Name: [Name of Representative] Title: [Title] Date: [Date]

For Processor: Signature: __________ Printed Name: [Name of Representative] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework intended for informational purposes only. It does not constitute legal advice. Laws regarding data privacy vary significantly by jurisdiction; consult with qualified legal counsel to ensure compliance with specific regional requirements such as GDPR, CCPA, or other mandates.