Free Data Processing Agreement Template
DATA PROCESSING AGREEMENT
This Data Processing Agreement ("Agreement") is entered into by and between [Data Controller's Name] (the "Controller") and [Data Processor's Name] (the "Processor") collectively referred to as the "Parties," effective as of [Date].
1. Definitions and Interpretation
In this Agreement, unless the context requires otherwise, the following terms shall have the meanings ascribed to them:
-
Data Controller: The entity that has been assigned the responsibility for determining the purposes and the methodologies through which the processing of personal data will be undertaken.
-
Data Processor: The entity that assumes the responsibility for processing personal data is engaged in performing actions on behalf of the entity which is referred to as the Data Controller.
-
Data Subject: A person who is involved in a situation where their data is being processed.
-
Personal Data: Any piece of information that pertains to, relates to, or is connected with a person who has been identified specifically or who can be identified by means uniformly accepted by nature.
-
Processing: Any kind of operation that is carried out, or any set of multiple operations that are performed on an individual's data.
-
Security Incident: The act of accessing, utilizing, or disclosing personal data without having the appropriate authorization to do so.
2. Obligations of the Data Controller
The Controller offers a warranty and assures that it has secured all the required consents and authorizations. These securements are essential as they confer the Controller with the legitimate capacity to transfer Personal Data over to the Processor. Furthermore, this transfer is valid for the specific duration mentioned in this Agreement. Moreover, the transfer should strictly adhere to the purposes outlined in this Agreement. The Controller affirms all these conditions and provisions.
3. Obligations of the Data Processor
The Processor hereby consents and commits to carry out the processing of Personal Data. This processing will be done exclusively based on documented instructions briefly provided by the Controller. However, if applicable law imposes a mandate on the Processor to proceed with actions that deviate from the Controller's instructions, the Processor will be obligated to abide by such laws, thereby processing data without relying strictly on the documented guidelines from the Controller.
4. Sub-processors
The Processor is strictly prohibited from engaging the services of another processor until they have obtained authorization in writing, which can be either specific or general, from the Data Controller beforehand.
5. Data Security, Auditing, and Notification
Both parties involved agree on the responsibility of implementing the necessary technical and organizational measures, that they deem appropriate, to ensure the security and privacy of Personal Data. This includes the implementation of protective measures that would prevent accidental or unlawful destruction or loss of data. It also includes procedures to deter unauthorized alterations to said data, as well as unauthorized disclosures or access. By doing so, the integrity and confidentiality of personal data are safeguarded.
6. Termination and Deletion or Return of Personal Data
When this Agreement comes to an end or is terminated, it is expected the Processor to comply with the directives of the Data Controller. This might require the Processor to erase all Personal Data from their records or return the said data to the Controller. Additionally, the Processor is also expected to eliminate any copies of the data that might still exist in their repositories. However, there could be exceptions to this when there is a need to retain any of the data as a result of statutory requirements as per applicable law.
7. Confidentiality
Each Party to this Agreement hereby mutually accepts and commits to maintaining the confidentiality of this Agreement as well as any Confidential Information that they receive from the other Party involved. Both Parties pledge not to disclose or make use of such information unless it becomes a necessity under the law, or they receive express authorization, in the form of written consent, from the other Party.
8. Liability
Neither of the involved parties shall be allowed to exclude or remove their liability or legal responsibility in cases of fraudulent misrepresentation, which refers to presenting false or incorrect information to deceive or gain unmerited advantage.
The effectiveness of this Agreement comes into force or commencement from the date that is initially written at the beginning or on top of this agreement.
[Your Name]
[Your Company Name]
[Data Processor's Name]
[Data Processor's Company Name]
