data processing agreement template south africa

Data Processing Agreement (POPIA Compliant)

Instructions for Use

• Fill in all bracketed information [__________] to accurately identify the parties, the specific nature of the data processing, and the security measures involved.
• Ensure that the "Purpose of Processing" section aligns precisely with the consent or legal basis obtained from the Data Subjects under the Protection of Personal Information Act (POPIA).
• Both parties must sign and date the document, and it should be kept on file as part of your organization's record-keeping obligations under Section 14 of POPIA.

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into by and between: The Responsible Party: [Company Name], a company incorporated under the laws of South Africa, with its registered office at [Registered Address] ("Responsible Party"). The Operator: [Company Name], a company incorporated under the laws of South Africa, with its registered office at [Registered Address] ("Operator").

Definitions:

• "Personal Information" shall have the meaning ascribed to it in Section 1 of the Protection of Personal Information Act, 2013 ("POPIA").
• "Processing" means any operation or activity, whether or not by automatic means, concerning personal information.

2. Nature and Purpose of Processing

The Operator shall process Personal Information only for the following purpose: [Describe specific business purpose, e.g., cloud hosting, payroll services, or marketing analytics]. The duration of the processing shall be for the term of the [Service Agreement Name] or until the termination of this DPA.

3. Obligations of the Operator

The Operator shall:

1. Process Personal Information only on documented instructions from the Responsible Party.
2. Ensure that persons authorized to process the Personal Information have committed themselves to confidentiality.
3. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Section 19 of POPIA.
4. Assist the Responsible Party by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Responsible Party’s obligation to respond to requests for exercising Data Subject rights.
5. Notify the Responsible Party without undue delay after becoming aware of a personal information breach.

4. Sub-processing

The Operator shall not engage another processor (sub-processor) without prior specific or general written authorization of the Responsible Party. Where the Operator engages a sub-processor, it shall impose the same data protection obligations as set out in this DPA.

5. International Transfers

The Operator shall not transfer Personal Information outside of the Republic of South Africa unless such transfer complies with the requirements of Section 72 of POPIA (e.g., the recipient is subject to a law or agreement that provides an adequate level of protection).

6. Termination and Deletion

Upon the termination of the services, the Operator shall, at the choice of the Responsible Party, delete or return all the Personal Information to the Responsible Party and delete existing copies, unless applicable law requires storage of the Personal Information.

7. Signature and Acknowledgment

By signing below, the parties agree to be bound by the terms of this DPA.

For the Responsible Party: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

For the Operator: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer

This document is a general framework intended for informational purposes and does not constitute formal legal advice. POPIA compliance is highly fact-specific; consult with qualified legal counsel to ensure this agreement meets the specific requirements of your industry and data handling practices.