data processing agreement template ireland

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields with the specific legal details of the Controller and Processor.
• Ensure the "Description of Processing" in the Annex is completed with sufficient detail to satisfy Article 28(3) of the GDPR.
• Review the security measures listed in the Annex to ensure they accurately reflect the actual technical and organisational measures implemented by the Processor.

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into by and between:

Controller: [Full Legal Name of Controller], with its principal place of business at [Registered Address of Controller] ("Controller").

Processor: [Full Legal Name of Processor], with its principal place of business at [Registered Address of Processor] ("Processor").

Definitions:

• "GDPR" means the General Data Protection Regulation (EU) 2016/679.
• "Personal Data," "Data Subject," "Processing," and "Controller/Processor" shall have the same meanings as defined in the GDPR.
• "Services" means the services provided by the Processor to the Controller as described in the [Agreement/Service Contract Name].

2. Processing of Personal Data

2.1 The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation. 2.2 The Processor shall ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3. Security of Processing

3.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

4. Sub-processors

4.1 The Processor shall not engage another processor without prior specific or general written authorisation of the Controller. 4.2 The Processor shall ensure that the same data protection obligations as set out in this DPA are imposed on that sub-processor by way of a contract.

5. Data Subject Rights

5.1 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the Data Subject's rights.

6. Audit and Compliance

6.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

7. Duration and Termination

7.1 This DPA shall become effective on [Date] and shall continue for the duration of the Services. Upon termination, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller.

Annex: Description of Processing

• Subject Matter: [Describe the nature of the data processing]
• Duration: [Specify the duration of processing]
• Nature and Purpose: [Describe the purpose of the processing]
• Types of Personal Data: [List categories of data, e.g., contact details, financial info]
• Categories of Data Subjects: [List categories, e.g., employees, customers]

Signature and Acknowledgment

By signing below, the parties agree to the terms of this DPA.

For the Controller: Signature: __________ Printed Name: [Name of Signatory] Title: [Job Title] Date: [Date]

For the Processor: Signature: __________ Printed Name: [Name of Signatory] Title: [Job Title] Date: [Date]

Legal Disclaimer

This document is a general framework intended for informational purposes and does not constitute legal advice. Users should consult with qualified legal counsel to ensure compliance with specific Irish law, the Data Protection Act 2018, and the GDPR.