data processing agreement template singapore

Data Processing Agreement (Singapore PDPA Compliant)

Instructions for Use

• Complete all bracketed fields with the legal names, addresses, and specific details of the Data Controller and Data Processor.
• Review the "Nature and Purpose of Processing" section to ensure it accurately describes the specific services being performed under the relevant Service Agreement.
• Ensure that the individual signing this document has the appropriate corporate authority to bind their respective organization to these data protection obligations.

1. Parties

This Data Processing Agreement ("DPA") is entered into on [__________] (the "Effective Date") by and between:

Data Controller: [Full Legal Name of Controller], a company incorporated in [Jurisdiction] with its registered office at [Registered Address] ("Controller").

Data Processor: [Full Legal Name of Processor], a company incorporated in [Jurisdiction] with its registered office at [Registered Address] ("Processor").

2. Definitions

• "PDPA" means the Personal Data Protection Act 2012 of Singapore, including any regulations or guidelines issued by the PDPC.
• "Personal Data" has the meaning ascribed to it under the PDPA, which is processed by the Processor on behalf of the Controller.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, use, disclosure, storage, or destruction.

3. Roles and Scope

The Controller engages the Processor to provide [Description of Services], which involves the processing of Personal Data as described in Annex A. The Processor acts as a data intermediary under the PDPA.

4. Obligations of the Processor

The Processor shall:

1. Process Personal Data only on documented instructions from the Controller.
2. Implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, collection, use, disclosure, or similar risks.
3. Ensure that all employees or agents authorized to process the Personal Data are under confidentiality obligations.
4. Assist the Controller in responding to requests from individuals exercising their rights under the PDPA.
5. Notify the Controller without undue delay upon becoming aware of any personal data breach.
6. Cease processing and delete or return all Personal Data to the Controller upon the termination of the service agreement.

5. Sub-processing

The Processor shall not appoint a third-party sub-processor without the prior written authorization of the Controller. The Processor remains fully liable for the acts and omissions of any sub-processor appointed.

6. International Transfers

The Processor shall not transfer Personal Data outside of Singapore unless it ensures that the recipient is bound by legally enforceable obligations to provide a standard of protection for the Personal Data that is comparable to the protection under the PDPA.

7. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

8. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the Republic of Singapore.

Signature & Acknowledgment

For and on behalf of the Controller: Signature: __________ Printed Name: [] Title: [] Date: [__________]

For and on behalf of the Processor: Signature: __________ Printed Name: [] Title: [] Date: [__________]

Legal Disclaimer: This template is provided for general informational purposes only and does not constitute legal advice. Data protection requirements are fact-specific and subject to ongoing regulatory updates. You should consult with qualified legal counsel in Singapore to ensure this agreement satisfies your specific compliance obligations under the PDPA.