International Data Processing Agreement
Parties
This agreement is dated the date on which it is signed by the last of the parties.
This agreement is made between [Controller] (the "Controller") and [Processor] (the "Processor").
Key Terms
"Main Agreement" means [Main Agreement (the contract under which the Processor provides services)].
"Data Protection Laws" means all laws on the protection of personal data that apply to the processing of Personal Data under this agreement, including, where they apply, the EU GDPR and the UK GDPR, as amended or replaced from time to time.
Definitions
"Personal Data" means any personal data that the Processor processes on behalf of the Controller in connection with the Main Agreement.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
"Sub-processor" means any processor engaged by the Processor to process Personal Data. "Affiliate" means, in relation to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party, where "control" means holding more than 50% of the voting rights or having the power to direct its management and policies.
"EU GDPR" means Regulation (EU) 2016/679, and "UK GDPR" has the meaning given in the UK Data Protection Act 2018. Other terms defined in Data Protection Laws and used in this agreement, including "personal data", "processing", "data subject", "controller", "processor" and "supervisory authority", have the same meanings here.
Roles and Scope
For the Personal Data, the Controller is the controller and the Processor is the processor. Where the Controller is itself a processor for another controller, the Processor acts as its Sub-processor and the Controller's instructions include those it receives from that controller. This agreement forms part of the Main Agreement and applies for as long as the Processor processes Personal Data. The Processing Details schedule sets out the subject matter and duration of the processing, its nature and purpose, the types of Personal Data and the categories of data subjects.
Controller Responsibilities
The Controller is responsible for having a lawful basis for the processing and for giving data subjects the information Data Protection Laws require. Its instructions must comply with Data Protection Laws. Before the processing starts, and whenever the risk changes, the Controller must tell the Processor about any sensitive or special category data and any other risk to individuals that the Processor needs to know to protect the Personal Data.
Processing Instructions
The Processor must process Personal Data only on the Controller's documented instructions, including with regard to international transfers, unless applicable law requires it to do otherwise. In that case the Processor must tell the Controller of that legal requirement before processing, unless that law prohibits this on important grounds of public interest. The Controller's instructions are this agreement, the Main Agreement and any further written instructions it gives that are consistent with them.
The Processor must immediately tell the Controller if, in its opinion, an instruction infringes Data Protection Laws. The Processor may suspend the affected processing until the Controller confirms, changes or withdraws the instruction. If the Controller maintains an instruction that the Processor reasonably considers unlawful, either party may terminate the affected services on written notice.
Confidentiality
The Processor must ensure that each person it authorises to process Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to perform the Main Agreement.
Security
The Processor must implement and maintain the measures in the Security Measures schedule and any other technical and organisational measures Data Protection Laws require to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risk to individuals. The Processor must regularly test and review those measures. It may update them, provided no update materially reduces the overall level of protection.
Sub-processors
The Controller gives general written authorisation for the Processor to engage the Sub-processors listed in the Approved Sub-processors schedule and others notified under this clause. The Processor must notify the Controller in writing of any intended addition or replacement at least 30 days before it takes effect, identifying the Sub-processor, its location and the processing it will perform. The Controller may object on reasonable data protection grounds within that period, and the parties must then discuss the objection in good faith. If it is not resolved before the change takes effect, the Controller may terminate the affected services on written notice and receive a refund of charges prepaid for the period after termination.
Before a Sub-processor processes Personal Data, the Processor must bind it by a written contract imposing the same data protection obligations as this agreement, in particular sufficient guarantees of appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of each Sub-processor's obligations. On request, the Processor must give the Controller a copy of the relevant data protection terms, which may be redacted to protect confidential commercial information.
Assistance
Taking into account the nature of the processing, the Processor must assist the Controller by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights under Data Protection Laws. If the Processor receives such a request directly, it must forward it to the Controller within 5 working days and must not respond except on the Controller's documented instructions or as the law requires.
Third-Party Requests
If the Processor receives any inquiry or request from anyone else about the processing of Personal Data, the Processor must notify the Controller about the request and must not respond without the Controller's prior consent, unless applicable law requires otherwise. This includes a judicial, administrative or regulatory agency order concerning Personal Data where notifying the Controller is not prohibited by applicable law, or a request from a data subject. If allowed by applicable law, the Processor must follow the Controller's reasonable instructions about these requests, including providing status updates and other information reasonably requested by the Controller. The Processor must cooperate with and provide reasonable assistance to the Controller, at the Controller's expense (except that the Assistance clause governs the cost of assistance with data subject requests), in any legal response or other procedural action taken by the Controller in response to a third-party request about the Processor's processing of Personal Data under this agreement.
Assistance
Taking into account the nature of the processing and the information available to it, the Processor must assist the Controller in meeting its obligations under Data Protection Laws on security of processing, notifying Personal Data Breaches to supervisory authorities and data subjects, data protection impact assessments, transfer impact assessments and prior consultation with supervisory authorities. The Controller must pay the Processor's reasonable charges, agreed in advance, for assistance beyond the services under the Main Agreement, unless the assistance is needed because of the Processor's breach of this agreement.
Personal Data Breaches
The Processor must notify the Controller of a Personal Data Breach without undue delay, and in any event within 48 hours, after becoming aware of it. The notice must describe, so far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact point for more information. The Processor must give further information in phases, without undue delay, as it becomes available.
The Processor must promptly take reasonable steps to contain, investigate and mitigate a Personal Data Breach and must cooperate with the Controller's response. Unless the law requires otherwise, the Processor must not notify any supervisory authority, data subject or other third party of a Personal Data Breach without the Controller's prior written approval. A notification or response by the Processor is not an admission of fault or liability.
Controller Breach Notification Responsibility
The Controller is solely responsible for complying with Personal Data Breach notification laws applicable to the Controller and for fulfilling any obligations to give notices to supervisory authorities, affected individuals or others relating to any Personal Data Breach.
International Transfers
The Processor must not transfer Personal Data to another country or an international organisation, including by allowing access from another country, except on the Controller's documented instructions and in compliance with Data Protection Laws. The Controller instructs transfers to the processing locations in the Processing Details schedule and to Sub-processors authorised under the Sub-processors clause at their notified locations. Where Data Protection Laws restrict a transfer, the parties must put in place the standard contractual clauses or other model transfer terms approved under Data Protection Laws before it takes place, and the exporter must carry out any transfer impact assessment those laws require, with the importer's reasonable cooperation. The Processor must tell the Controller without undue delay if it can no longer comply with this clause.
By signing this agreement, the parties enter into the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") for each transfer of Personal Data from the Controller to the Processor that the EU GDPR restricts. Module Two applies where the Controller is a controller and Module Three where it is a processor. The optional docking clause does not apply. In Clause 9, Option 2 applies with the notice period in the Sub-processors clause, or Option 1 where that clause requires specific authorisation. The optional wording in Clause 11 does not apply. In Clause 17, Option 1 applies with the law of Ireland, and under Clause 18 its courts are chosen. The parties' details, the Processing Details, Security Measures and Approved Sub-processors schedules complete Annexes I to III, and Annex I.C names the supervisory authority determined under Clause 13. The EU SCCs prevail over this agreement if they conflict.
Where another transfer mechanism requires the parties to sign model clauses or an addendum, they must do so in its official form, completed from the schedules to this agreement. For a transfer that the UK GDPR restricts, these are the International Data Transfer Addendum to the European Commission's standard contractual clauses or the International Data Transfer Agreement, in the current version issued under section 119A of the UK Data Protection Act 2018. Those terms prevail over this agreement if they conflict.
UK Addendum Continuity
Neither party may end the International Data Transfer Addendum to the European Commission's standard contractual clauses (the "UK Addendum") as set out in Section 19 of the UK Addendum; to the extent the ICO issues a revised Approved Addendum under Section 18 of the UK Addendum, the parties must work in good faith to revise this agreement accordingly.
Swiss Transfer Adjustments
For each transfer of Personal Data where Swiss law, and not the law in any EEA member state or the United Kingdom, applies to the international nature of the transfer, the parties enter into the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") by signing this agreement, to the extent they have not already done so, with Module Two where the Controller is a controller and Module Three where it is a processor, completed from the schedules to this agreement; for those transfers, references to the EU GDPR in the EU SCCs are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead, and the concept of supervisory authority includes the Swiss Federal Data Protection and Information Commissioner.
Information and Audit
The Processor must make available to the Controller all information necessary to demonstrate compliance with this agreement and the processor obligations in Data Protection Laws, and must allow for and contribute to audits, including inspections, by the Controller or an independent auditor it mandates. The Controller must give at least 30 days written notice, and audits may take place no more than once in any 12-month period unless a Personal Data Breach, a supervisory authority or reasonable evidence of non-compliance requires otherwise. The Controller must take account of current independent audit reports or certifications the Processor provides when deciding the audit's scope. Audits must take place during business hours, with minimal disruption and under reasonable confidentiality and security conditions. Each party bears its own costs, unless the audit reveals a material breach by the Processor, which must then reimburse the Controller's reasonable audit costs and promptly remedy the breach.
Return and Deletion
When the provision of services relating to the processing ends, the Processor must, at the Controller's choice, delete or return all Personal Data to the Controller within 30 days and delete existing copies, unless applicable law requires storage. If the Controller does not choose within that period, the Processor must delete it. Personal Data the Processor must store remains protected under this agreement, may be processed only for the purpose requiring storage, and must be deleted when that requirement ends. On request, the Processor must confirm deletion in writing.
Deletion During Services
The Processor must enable the Controller to delete Personal Data in a manner consistent with the functionality of the services under the Main Agreement. The Processor must comply with that instruction as soon as reasonably practicable except where further storage of Personal Data is required by Data Protection Laws.
Liability
Each party's liability arising out of or in connection with this agreement is subject to the limitations and exclusions of liability in the Main Agreement, and claims under this agreement and the Main Agreement count together towards any cap. Nothing in this agreement limits or excludes liability to data subjects under Data Protection Laws or a transfer mechanism, or any liability that cannot be limited or excluded by law.
Related-Party Claims
Except for claims by a data subject to the extent Data Protection Laws or a transfer mechanism gives it that right, any claims made against the Processor or its Affiliates arising out of or related to this agreement may only be brought by the Controller entity that is a party to the Main Agreement.
Term and Termination
This agreement continues until the Processor has stopped processing Personal Data and has returned or deleted it under the Return and Deletion clause. If the Processor breaches this agreement or Data Protection Laws, the Controller may instruct it to suspend the affected processing until the breach is remedied. The Controller may terminate the affected services under the Main Agreement on written notice if the Processor commits a material breach of this agreement that cannot be remedied or is not remedied within 30 days after written notice.
General
If this agreement conflicts with the Main Agreement on the processing of Personal Data, this agreement prevails, and any transfer terms entered into under the International Transfers clause prevail over both. Notices under this agreement are given as the Main Agreement provides, but Personal Data Breach notifications and data subject requests may also be sent to the privacy contacts in the Processing Details schedule.
If a change in Data Protection Laws, or guidance or a decision of a supervisory authority or court, requires a change to this agreement or to a transfer mechanism, the parties must negotiate in good faith and agree the minimum change needed.
No person other than the parties may enforce this agreement, except a data subject to the extent Data Protection Laws or a transfer mechanism gives it that right.
Governing Law and Disputes
This agreement and any non-contractual obligations arising out of or in connection with it are governed by the law that governs the Main Agreement or, if it specifies none, the law of England and Wales. Any dispute arising out of or in connection with this agreement must be resolved by the courts or arbitral tribunal having jurisdiction under the Main Agreement or, if it specifies none, arbitration in London under the LCIA Rules. This does not affect any jurisdiction that Data Protection Laws or a transfer mechanism gives to a supervisory authority, a court or a data subject.
Processing Details
Subject matter: the Processor's provision of the services described in the Main Agreement. Duration: the term of the Main Agreement and any later period until the Personal Data is returned or deleted under the Return and Deletion clause. Nature of the processing: [Nature of the processing (the operations performed)]. Purpose: [Purpose of the processing]. Types of Personal Data: [Types of personal data]. Sensitive or special category data, and the additional safeguards applied: none. Categories of data subjects: [Categories of data subjects]. Processing locations: [Processing locations (countries)]. Controller privacy contact: [Controller privacy contact]. Processor privacy contact: [Processor privacy contact].
Security Measures
The Processor must implement at least the following technical and organisational measures: access to Personal Data limited to personnel who need it, with unique user accounts and multi-factor authentication for administrative and remote access; encryption of Personal Data in transit over public networks and at rest where appropriate to the risk; logging and monitoring of access to systems that hold Personal Data; vulnerability management, patching and malware protection; backups and tested recovery procedures; a documented incident-response procedure; confidentiality undertakings and data protection training for personnel; physical security for premises and equipment used for the processing; and regular testing and evaluation of the effectiveness of these measures.
Approved Sub-processors
Sub-processors authorised at the date of this agreement (name, location and processing performed): none.
Sub-processor List Maintenance
The Processor must maintain an up-to-date list of its Sub-processors, including their functions and locations, in the Approved Sub-processors schedule or at a location it notifies to the Controller in writing. Keeping the list up to date does not replace the notice the Sub-processors clause requires.
Artificial Intelligence and Automated Processing
The Processor must not use Personal Data to train, fine-tune, develop or improve any artificial intelligence or machine learning model, whether its own or a third party's, unless (a) that use is reasonably necessary to provide the services under the Main Agreement in accordance with the Controller's documented instructions, or (b) the Controller has expressly authorised it in writing. The Processor must prohibit its Sub-processors, including any providers of artificial intelligence models, from using Personal Data for their own model training, fine-tuning, development or improvement, except as the Controller expressly authorises in writing. If the services involve automated decision-making that produces legal effects concerning individuals or similarly significantly affects them, the Processor must: (a) disclose that processing to the Controller; (b) to the extent reasonably available to it, provide meaningful information about the logic involved, without being required to disclose its trade secrets or confidential information; and (c) reasonably cooperate with the Controller, as Data Protection Laws require, to enable data subjects to exercise their rights relating to automated decision-making.