data processing agreement template philippines

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields with the specific legal names, addresses, and registration details of the Controller and the Processor.
• Review the "Nature and Purpose of Processing" section to ensure it accurately reflects the specific business activities and types of personal data being shared.
• Ensure both parties sign the document in the presence of witnesses or via authorized digital signatures to ensure enforceability under the Data Privacy Act of 2012 (Republic Act No. 10173).

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into on [Date] by and between:

Controller: [Full Legal Name of Controller], a corporation organized and existing under the laws of the Philippines, with principal office at [Full Business Address], represented herein by [Name of Authorized Signatory], [Title].

Processor: [Full Legal Name of Processor], a corporation organized and existing under the laws of the Philippines, with principal office at [Full Business Address], represented herein by [Name of Authorized Signatory], [Title].

Definitions:

• "Data Privacy Act" means Republic Act No. 10173 and its Implementing Rules and Regulations.
• "Personal Data" means any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained.
• "Processing" means any operation or set of operations performed upon Personal Data, including collection, recording, organization, storage, updating, modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction.

2. Obligations of the Processor

The Processor shall:

1. Process Personal Data only on documented instructions from the Controller, including regarding transfers of Personal Data to a third country or an international organization.
2. Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by the National Privacy Commission (NPC).
4. Not engage another processor without prior specific or general written authorization of the Controller.
5. Assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the data subject's rights.
6. Assist the Controller in ensuring compliance with the obligations pursuant to the Data Privacy Act, including security of processing, notification of a personal data breach, and data protection impact assessments.

3. Nature and Purpose of Processing

The Processor shall process data for the following specific purposes: [Describe business purpose, e.g., cloud hosting, payroll services, marketing analytics]. The categories of data subjects are: [e.g., Employees, Customers, End-users]. The types of Personal Data involved are: [e.g., Names, Email Addresses, Contact Numbers, Financial Records].

4. Data Breach Notification

In the event of a Personal Data breach, the Processor shall notify the Controller without undue delay after becoming aware of the breach. Such notification shall at minimum:

1. Describe the nature of the personal data breach.
2. Provide the name and contact details of the data protection officer or other contact point.
3. Describe the likely consequences of the personal data breach.
4. Describe the measures taken or proposed to be taken to address the personal data breach.

5. Term and Termination

This DPA shall remain in effect for the duration of the underlying service agreement between the parties. Upon termination, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies unless applicable law requires storage of the Personal Data.

6. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Republic of the Philippines. Any disputes arising hereunder shall be subject to the exclusive jurisdiction of the courts of [City/Municipality], Philippines.

Signature and Acknowledgment

For the Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

For the Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. You must consult with qualified legal counsel in the Philippines to ensure compliance with the specific requirements of the National Privacy Commission and the Data Privacy Act of 2012.