Data Processing Agreement

Template

Agreement on personal data processing to the Agreement …………………………… concluded by between

… as a Controller and

… as a Processor

Agreement on personal data processing supplementing the Agreement ……………… concluded on ……………………. in , by and between:

… (“Controller”)

and

… (“Processor”)

(hereinafter jointly referred to as “Parties”) As:

1. i.The Parties entered into the agreement (“Main Agreement”)
2. and in connection with the performance of the Main Agreement, the Controller entrusts processing of personal data with the Processor within the scope specified in the Agreement;
3. ii.The purpose of this Agreement is to set out the terms under which the Processor carries out data processing operations on behalf of the Controller;
4. iii.By entering into this Agreement, the contracting Parties intend to set out rules on personal data processing in accordance with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”)

The Parties agreed to enter the following Agreement:

1. 1.Description of the processing
   1. 1.1.Subject matter. [GDPR.28.1] Under the terms of this Agreement and the Main Agreement, the Controller vests processing (as defined in the GDPR) of further described Personal Data to the Processor.
   2. 1.2.Duration. [GDPR.28.3] Processing will be performed during the term of the Main Agreement.
   3. 1.3.The nature and purpose of the processing. [GDPR.28.3] The nature and purpose of the processing is provided in the Main Agreement. In particular:
      1. 1.3.1.the nature of the processing is specified by the following task of the Processor [example: providing accounting services for the Controller], whereas
      2. 1.3.2.the purpose of the processing is [example: enabling the Controller to fulfil his obligations arising from the law connected to accounting management as well as financial management of the Controller]
   4. 1.4.Type of personal data. [GDPR.28.3] The processing includes following types of personal data (“Data”):
   5. Standard Data
2. 1)name and surname
3. 2)Personal Identity No.
4. 3)e-mail address
5. 4)IP address
6. 5)phone numbers
7. 6)address of residence
8. 7)date of birth
9. 8)Tax Identification Number
10. 9)ID series and number
11. 10)parent’s names
12. 11)bank account number
13. 12)…………………….
    1. Special categories Data and criminal Data:
14. 13)medical records
15. 14)……………………
16. 15)…………………..
    1. Children’s data
17. 16)name and surname
18. 17)date of birth
19. 18)e-mail address
20. 19)alias
21. 20)………………………
    1. Unstructured data
22. 21)content potentially and probably consisting of personal data (entries, documents, pictures, footages, recordings)
    1. 1.5.Categories of data subjects. [GDPR 28.3] The processing of Data concerns following categories of data subjects:
23. 1)employees of the Controller and affiliated entities
24. 2)clients of the Controller’s service/product as specified in the Main Agreement
25. 3)persons, with whom Controller’s clients engage into social interactions
26. 4)contractors (recipients and suppliers) of Controller’s clients
27. 5)recipients of the Controller’s clients’ electronic correspondence
28. 6)……………………………………………………………………..
29. 7)…………………………………………………………………….
30. 8)……………………………………………………………………

Sub-processing

1. 2.1.Sub-processing. [GDPR.28.2] The Processor may vest specific Data processing operations (“sub-processing”) in form of a written sub-processing agreement (“Sub-processing Agreement”) to another data processing entity (“Sub-processor”), provided the Controller does not object to such sub-processing.
2. 2.2.Accepted Sub-processors. A list of Sub-processors accepted by the Controller constitutes Annex no. 1 to the Agreement – “List of Accepted Subprocessors”.
3. 2.3.Right to object. Vesting data processing to Sub-processors not included on the List of Accepted Sub-processors requires prior notification to the Controller in order to enable him to object. The Controller may, due to compelling reasons, object in a documented way explaining the reasons to objecting to vesting data processing to a specific Sub-processor. If the objection is raised, the Processor is not authorized to entrust data with the objected Sub-processor, and if the objection concerns a current Sub-processor, the Processor must terminate entrusting data processing with the Sub-processor in question without undue delay. Any doubts about legitimacy of the objection and potential negative consequences must be reported by the Processor to the Controller in a time enabling the continuity of the processing.
4. 2.4.Transfer of obligations. [GDPR.28.4] While further entrusting the processing of data, the Processor must oblige the Sub-processor to fulfil all of Processors’ obligations arising from this Agreement, excluding those, which do not apply due to a nature of a specific sub-processing.
5. 2.5.Obligation towards the Controller. The Processor ensures that the Sub-processor undertakes directly to the Controller to fulfil all of the obligations specified in the previous section. Such obligation may be performed by submitting a relevant statement, including a list of Sub-processor’s obligations or a copy of a sub-processing agreement, addressed to the Controller, along with signing of the Sub-processing Agreement.
6. 2.6.Prohibition on subcontracting of the subject-matter of the Agreement. [GDPR.28.4] The Processor is not authorized to subcontract the performance of the entirety of this Agreement to a Sub-processor.

1. 3.The Processor’s obligations

The Processor’s obligations are as follows:

1. 3.1.Documented instructions. [GDPR.28.3.a] The Processor processes Data only in accordance with documented instructions given by the Controller.
2. 3.2.No processing outside EEA. [GDPR 28.3.a] The Processor declares that they do not transfer Data to a third country or an international organization (meaning outside of the European Economic Area (“EEA”)). Processor also declares, that they are not using any subcontractors who transfer Data outside of the EEA.
3. 3.3.Intention of processing outside EEA. [GDRP 28.3] Where the Processor intends or is obliged to transfer Data outside of the EEA, the Processor informs the Controller in advance, in order to enable the Controller to take a decision and relevant measures necessary to ensure compliance of the processing with the law or to terminate the processing.
4. 3.4.Confidentiality [GDPR.28.3.b.] The Processor obtains documented non disclosure undertakings from persons authorised to process Data in the course of performance of this Agreement or makes sure that such persons are subjected to legal obligation of confidentiality.
5. 3.5.Security [GDPR.28.3.b] The Processor ensures Data security and implements technical and organisational data security measures as described in the Article 32 GDPR, in accordance to further provisions of the Agreement.
6. 3.6.Sub-processing [GDPR.28.3.d] The Processor fulfils the conditions of using another processor (Sub-processor).
7. 3.7.Data subjects’ rights cooperation [GDPR.28.3e] The Processor undertakes to the Controller to help the Controller to respond to the data subjects’ requests described in the GDPR’s chapter III (“Rights of the data subject”). In particular the Processor is responsible to the Controller for processing data subjects’ requests to the extent such requests refer to processing performed by the Processor.
8. 3.8.Support with security measures [GDPR 28.3.f] The Processor supports the Controller with the fulfilment of the data security duties described in articles 32-36 of the GDPR (security of the processing, breach notification, communication of a breach to data subjects, data protection impact assessment, prior consultation with the supervisory authority).
9. 3.9.Legality of the Controller’s instructions [GDPR.28.3.par2] In the case the Processor has doubts about the legality of instructions given by the Controller, the Processor immediately informs the Controller on the doubts (in a documented way and with an explanation). If the Processor fails to timely inform the Controller about their doubts as to the legality of a particular instruction the Controller is relieved from liability to the Processor for the lack of legality of related instructions.
10. 3.10.Privacy by design [GDPR.25.1] While planning a change in the processing of Data, the Processor is obliged to assess impact of the change on data protection and is obliged to inform the Controller on the planned changes and their privacy impact in advance in such a way and time, that the Controller has a real possibility to react, if the changes planned by the Processor endanger the agreed level of security of Data or increase the risk to the rights and freedoms of natural persons, posed by the processing of Data by the Processor.
11. 3.11.Data minimisation [GDPR.25.2] The Processor undertakes to limit access to Data only to persons, whose access to Data is necessary for the performance of this Agreement, and who have an appropriate authorisation.
12. 3.12.RCPA [GDPR.30.2] The Processor undertakes to keep the documentation describing means of data processing, including a record of categories of processing activities (Article 30 GDPR). The Processor, upon the Controller’s request, makes the record of categories of processing activities available, excluding information containing business secrets of the Processor’s other clients.
13. 3.13.Profiling and automated decision making [GDPR.13 and 14] If the Processor uses an automated decision making for the performance of this Agreement, including profiling as described in articles 22.1 and 22.4 of the GDPR, the Processor informs the Controller on such processing in the scope necessary to enable the Controller to fulfil the information obligations.
14. 3.14.Personnel training. The Processor undertakes to provide persons authorised to process Data with appropriate trainings in the scope of personal data protection.

The Controller’s obligations

1. 4.1.The Controller is obliged to cooperate with the Processor in the course of performance of the Data Processing Agreement, provide the Processor with explanations in case of any doubts as to the lawfulness of the Controller’s instructions and to fulfil his detailed duties in a timely manner.

Data security

1. 5.1.Personal data security [GDPR.32] The Processor has carried out a risk analysis of vested Data, provided it to the Controller and applies its result as to the organisational and technical security measures.
2. 5.2.Security measures. The Parties agreed upon a level of security required of the Processor in a separate document.
3. 5.3.Security guarantees. The Processor has provided the Controller with information and documents confirming that the Processor ensures sufficient guarantees of implementing appropriate technical and organisational measures. Both Parties retain copies of the provided documentation and proofs of providing information, for the purposes of accountability.

Data breach notification

1. 6.1.Data breach notification. The Processor notifies the Controller of any suspicion of Data security breach no later than 24 hours from the first information on the suspicion, enables the Controller to participate in investigations, and informs the Controller about findings at the moment of their determination, in particular if the breach was found.
2. 6.2.Notification. A breach notification should be provided with all the necessary documentation regarding the breach, so the Controller may fulfil the obligation of notifying of the supervisory authority.

Supervision

1. 7.1.Control [GDPR.28.3.h] The Controller may audit means of Data processing after a prior notification about a planned control. The Controller or persons authorised by the Controller are allowed to (i) enter the rooms, where Data is processed and (ii) inspect the documentation connected to Data processing. The Controller is entitled to request information on the course of the processing from the Processor, as well as request access to the processing records.
2. 7.2.The Processor:

1. 1)provides the Controller with any information necessary to demonstrate compliance of the Controller’s conduct with the GDPR,
2. 2)enables the Controller or an authorised auditor to perform an audit or inspection. The Processor cooperates in the scope of a performance of audits or inspections.

Representations and Warranties

1. 8.1.The Controller. The Controller hereby represents that he is the Data Controller and is authorised to process Data in the scope of entrusting of the processing to the Processor.
2. 8.2.The Processor. The Processor herby represents that, in the scope of his business activities, he professionally processes data as described in this Agreement and the Main Agreement, holds the necessary knowledge in that scope, implements appropriate technical and organisational measures and warrants a proper performance of this Agreement.
3. 8.3.Letters of recommendation. Upon the Controller’s request, the Processor will present appropriate letters of recommendation, list of experience, financial information or other proofs, warranting the proper performance of this Agreement.

Liability

1. 9.1.The Processor’s liability [GDPR.82.2] The Processor is liable for the damage caused by his actions where he has not complied with the GDPR obligations specifically directed to the processors or where they have acted outside lawful instructions of the Controller or against such instructions. The Processor is liable for the damage caused by an incorrect implementation or lack of an implementation of appropriate security measures.
2. 9.2.Liability for Sub-processors [GDPR.28.4] If the Sub-processor fails to comply with his data protection obligations, the Processor remains fully liable to the Controller for the performance of the Sub-processor’s obligations.

Term of the Agreement

1. 10.1.[GDPR.28.3] The Agreement has been concluded for the term of the Main Agreement.

Data erasure

1. 11.1.Data erasure [GDPR.28.3.g] Upon termination of the Main Agreement, the Processor is no longer authorised to process Data and is obliged to:

1. 1)erase Data
2. 2)erase all of existing copies of Data or return Data, unless the Controller decides otherwise or EU or member state’s law requires storage of the Data
   1. 11.2.Grace period. The Processor erases Data after 180 days from the termination of the Agreement, unless the Controller request the Processor to do so earlier.
   2. 11.3.Declaration. After erasing or returning of Data, the Processor submits to the Controller a written statement confirming a permanent erasure of all Data.

Final provisions

1. 12.1.Priority. In the case of any discrepancies between provisions of this Agreement and the Main Agreement, the provision of this Agreement shall prevail. This means, that all matters regarding personal data processing between the Controller and the Processor should be regulated by amendments to this Agreement or by the performance of its provisions.
2. 12.2.Copies. This Agreement has been drafted in two identical copies, one for each of the Parties.
3. 12.3.Governing law. This Agreement is subject to the law and the GDPR.