data processing agreement australia template

Australian Data Processing Agreement

Instructions for Use

• Complete all bracketed fields to accurately reflect the identities and specific data handling practices of your organization.
• Ensure the "Nature of Processing" section aligns with your actual business operations to satisfy the transparency requirements under the Privacy Act 1988 (Cth).
• Review the technical and organisational security measures with your IT department before executing to ensure they are factually accurate for your infrastructure.

1. Parties and Definitions

This Agreement is entered into by and between: Controller: [Full Legal Name of Controller], located at [Controller Address] ("[Controller]") Processor: [Full Legal Name of Processor], located at [Processor Address] ("[Processor]")

Definitions:

• "Personal Information" has the meaning given in the Privacy Act 1988 (Cth).
• "Data Protection Laws" means the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs).
• "Services" means the services provided by the Processor to the Controller as described in [Reference to Service Agreement].

2. Processing of Personal Information

The Processor shall process Personal Information only on documented instructions from the Controller, including with regard to transfers of Personal Information to a third country or an international organisation, unless required to do so by Australian law.

3. Compliance and Obligations

The Processor warrants that it shall:

• Ensure that persons authorised to process the Personal Information have committed themselves to confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures specified in [Schedule A / Attached Security Policy].
• Assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights.
• Notify the Controller without undue delay after becoming aware of a personal information breach.

4. Sub-processing

The Processor shall not engage another processor without prior specific or general written authorisation of the Controller. The Processor shall ensure that the same data protection obligations as set out in this Agreement are imposed on that sub-processor.

5. International Transfers

The Processor shall not transfer Personal Information outside of Australia unless it ensures that the recipient is subject to a law or binding scheme that provides substantially similar protection to the APPs, or the Processor has taken such steps as are reasonable in the circumstances to ensure the information is handled in accordance with the APPs.

6. Audit and Termination

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Upon termination of the Services, the Processor shall, at the choice of the Controller, delete or return all Personal Information to the Controller.

7. Execution

For and on behalf of the Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

For and on behalf of the Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Disclaimer: This document is a general framework and does not constitute legal advice. You must consult with qualified legal counsel to ensure compliance with specific industry regulations and jurisdictional requirements under the Australian Privacy Act.