personal data processing agreement template

Data Processing Addendum

Instructions for Use

• Fill in all bracketed information [__________] to accurately reflect the identities and roles of the involved parties.
• Review the scope of services and nature of the data processing to ensure the "Description of Processing" section aligns with your specific operational requirements.
• Consult with your internal or external legal counsel to ensure this agreement satisfies the specific regulatory requirements of your jurisdiction (e.g., GDPR, CCPA/CPRA, etc.).

1. Parties and Definitions

This Data Processing Addendum ("Addendum") is entered into by and between:

Controller: [Company Name], a [Jurisdiction of Incorporation] corporation, with its principal place of business at [Full Address] ("Controller").

Processor: [Company Name], a [Jurisdiction of Incorporation] corporation, with its principal place of business at [Full Address] ("Processor").

Definitions: "Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation or set of operations performed on Personal Data. "Security Incident" means any unauthorized or unlawful breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data.

2. Scope and Nature of Processing

The Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions of the Controller. The subject matter, duration, nature, and purpose of the processing are as follows:

• Subject Matter: [__________]
• Duration: [__________]
• Nature and Purpose: [__________]
• Categories of Data Subjects: [__________]

3. Obligations of the Processor

The Processor shall: 3.1. Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 3.2. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. 3.3. Not engage another processor without prior specific or general written authorization of the Controller. 3.4. Assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller’s obligation to respond to requests for exercising the data subject's rights. 3.5. Assist the Controller in ensuring compliance with obligations regarding the security of processing and data protection impact assessments.

4. Data Subject Rights and Cooperation

The Processor shall notify the Controller without undue delay after becoming aware of a Security Incident. Upon termination of the services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller unless applicable law requires storage of the Personal Data.

5. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Addendum and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

6. Liability

Each party’s liability under this Addendum shall be subject to the limitations of liability set forth in the [Name of Primary Services Agreement], except where prohibited by applicable law.

7. Signature and Acknowledgment

Controller Signature: __________ Printed Name: [] Title: [] Date: [__________]

Processor Signature: __________ Printed Name: [] Title: [] Date: [__________]

Legal Disclaimer: This document is a general framework intended for informational purposes only and does not constitute legal advice. It may not satisfy specific regulatory requirements in your jurisdiction. You should consult with qualified legal counsel to ensure compliance with applicable data protection laws.