UAE Mainland Data Processing Agreement

Parties

This agreement is dated the date on which it is signed by the last of the parties.

This agreement is made between [Controller] (the "Controller") and [Processor] (the "Processor").

Key Terms

"Main Agreement" means [Main Agreement (the contract under which the Processor provides services)].

Definitions

"Data Protection Law" means Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, its Executive Regulations once issued, and binding decisions of the UAE Data Office, in each case as amended or replaced from time to time.

"Personal Data" means any personal data that the Processor processes on behalf of the Controller in connection with the Main Agreement. "Personal Data Breach" means any breach of the security of Personal Data, or any infringement of it, that compromises its privacy, confidentiality or security. Other terms defined in the Data Protection Law, including "processing", "sensitive personal data" and "data subject", have the same meanings here. The "Data Office" means the UAE Data Office established under Federal Decree-Law No. 44 of 2021.

Roles and Scope

For the Personal Data, the Controller is the controller and the Processor is the processor. The Processor confirms that it has sufficient guarantees to implement technical and organisational measures so that the processing meets the requirements of the Data Protection Law. This agreement forms part of the Main Agreement. The Processing Details schedule sets out the subject matter, processing period, nature and purpose of the processing and the categories of Personal Data and data subjects.

Controller Responsibilities

The Controller is responsible for the lawful basis of the processing, including any consent the Data Protection Law requires, and for giving data subjects the required information. Its instructions must comply with the Data Protection Law. The Controller must report Personal Data Breaches to the Data Office and data subjects where the Data Protection Law requires.

Changes to Data Protection Law

The parties will work together in good faith to negotiate an amendment to this agreement as either party reasonably considers necessary to address the requirements of the Data Protection Law from time to time.

Processing Instructions

The Processor must process Personal Data only in accordance with the Controller's instructions and this agreement, only for the purpose and during the processing period in the Processing Details schedule, and in accordance with the Data Protection Law and any instructions of the Data Office. The Controller's instructions are this agreement, the Main Agreement and any further written instructions it gives that are consistent with them.

If the Processor reasonably believes that an instruction breaches the Data Protection Law, it must promptly tell the Controller and may suspend the affected processing until the Controller confirms, changes or withdraws the instruction.

Confidentiality

The Processor must not do anything that would disclose Personal Data or the results of the processing, except as this agreement or the law permits. It must ensure that each person it authorises to process Personal Data is bound by confidentiality obligations and has access only where needed for the purpose.

Security

The Processor must apply appropriate technical and organisational measures to protect Personal Data, from the design stage of the processing, including the measures in the Security Measures schedule, and must protect and secure the processing and the electronic media and devices used for it. The measures must take account of the nature, scope and purposes of the processing, the risks to data subjects, available technology and cost. The Processor may update them, provided no update materially reduces the overall level of protection.

Controller Security Assessment

The Controller is responsible for reviewing the information made available by the Processor relating to data security and making an independent determination as to whether the services meet the Controller's requirements and legal obligations under the Data Protection Law.

Personal Data Breaches

The Processor must notify the Controller of a Personal Data Breach as soon as it becomes aware of it, and in any event within 24 hours. It must give the information then available about the breach, the Personal Data and data subjects affected, the likely consequences and the measures taken or proposed, update the Controller as more becomes known, take prompt steps to contain and remedy the breach, and cooperate with any investigation by the Data Office. It must not notify any third party without the Controller's approval unless the law requires it.

No Admission by Breach Notification

The Processor's notification of or response to a Personal Data Breach as required by this agreement will not be construed as an acknowledgment by the Processor of any fault or liability for the Personal Data Breach.

Assistance

If the Processor receives a request from a data subject about Personal Data, it must promptly forward it to the Controller and must not respond except on the Controller's written instructions or as the Data Protection Law requires. Taking into account the nature of the processing, the Processor must reasonably assist the Controller to respond to requests from data subjects to exercise their rights.

Taking into account the nature of the processing and the information available to it, the Processor must reasonably assist the Controller to comply with the Data Protection Law on security, Personal Data Breaches, impact assessments and enquiries from the Data Office. The Controller must reimburse the Processor's reasonable documented costs of assistance beyond the ordinary scope of the services, unless the need arose from the Processor's breach of this agreement or the Data Protection Law.

Authority Requests

Unless the law prohibits it, the Processor must promptly tell the Controller of any legally binding request, inspection or other contact from the Data Office or another competent authority concerning Personal Data, cooperate with the Controller's response and disclose Personal Data only to the extent legally required.

Sub-processors

The Processor may engage the sub-processors listed in the Approved Sub-processors schedule. It must notify the Controller in writing at least 30 days before engaging or replacing any other sub-processor, identifying it, its location and the processing it will perform, and the Controller may object on reasonable data protection grounds within that period. If an objection is not resolved, the Controller may terminate the affected services without penalty.

The Processor must engage each sub-processor under a written contract that clearly defines its obligations and imposes obligations no less protective than this agreement. The Processor remains responsible to the Controller for each sub-processor's acts and omissions in the processing.

Notice of Sub-processor Material Failure

The Processor must notify the Controller of any failure by its sub-processors to fulfil a material obligation concerning Personal Data under the agreement between the Processor and the sub-processor.

Sub-processor Agreement Disclosure

At the Controller's request, the Processor must share a copy of its agreements, including amendments, with its sub-processors. To the extent necessary to protect business secrets or other confidential information, including Personal Data, the Processor may redact the text of an agreement with a sub-processor before sharing a copy.

International Transfers

The Processor must not transfer Personal Data outside the UAE, or allow access to it from outside the UAE, except on the Controller's instructions, as recorded in the Processing Details schedule, and in compliance with the Data Protection Law. A transfer may be made only to a country whose legislation on personal data protection the Data Protection Law treats as adequate or, failing that, on a basis the Data Protection Law permits, such as a contract binding the recipient to apply the requirements and measures of the Data Protection Law. The Processor must tell the Controller without undue delay if it can no longer meet these conditions.

Records and Information

The Processor must keep a record of the Personal Data it processes on behalf of the Controller, as the Data Protection Law requires, and give it to the Controller or the Data Office on request. It must provide the Controller with the information and means reasonably needed to prove its compliance with this agreement and the Data Protection Law.

Audit

The Controller, or an independent auditor bound by confidentiality, may audit the Processor's compliance with this agreement on at least 30 days written notice and no more than once in any 12-month period, except after a Personal Data Breach or where the Data Office requires. Audits must take place during business hours, minimise disruption and follow the Processor's reasonable security rules. The Processor may meet a request with current independent audit reports or certifications where they reasonably demonstrate compliance.

Return and Erasure

When the processing period ends, or earlier when the Processor hands the Personal Data over to the Controller, the Processor must return any Personal Data the Controller requests and erase all Personal Data, including copies held by sub-processors, within 30 days, unless the law requires it to keep it. Personal Data it must keep remains protected under this agreement and may be processed only for that legal purpose. On request, the Processor must confirm erasure in writing.

Deletion During Services

The Processor must enable the Controller to delete Personal Data in a manner consistent with the functionality of the services. The Processor must comply with that instruction as soon as reasonably practicable except where further storage of Personal Data is required by the Data Protection Law.

Liability

The limitations and exclusions of liability in the Main Agreement apply to this agreement, and claims under both count together towards any cap. Nothing in this agreement limits liability to the extent it cannot lawfully be limited.

Related-Party Claims

Any claims made against the Processor or its affiliates arising out of or related to this agreement may only be brought by the Controller entity that is a party to the Main Agreement.

Term and Priority

This agreement takes effect on its date and continues until the Processor has returned and erased the Personal Data under the Return and Erasure clause. If it conflicts with the Main Agreement on the processing of Personal Data, this agreement prevails. Notices are given as the Main Agreement provides, but Personal Data Breach notices and data subject requests may also be sent to the privacy contacts in the Processing Details schedule.

Language

This agreement is made in English. If it is translated into Arabic, including for proceedings before a UAE court, the English text prevails between the parties to the extent the law allows.

Governing Law and Disputes

This agreement is governed by the federal laws of the United Arab Emirates and, where applicable, the laws of the Emirate of Dubai. The parties submit to the exclusive jurisdiction of the courts of the Emirate of Dubai for any dispute arising out of or in connection with it.

Processing Details

Subject matter: the Processor's provision of the services described in the Main Agreement. Processing period: the term of the Main Agreement, after which the Personal Data must be returned and erased under the Return and Erasure clause. Nature of the processing: [Nature of the processing (the operations performed)]. Purpose: [Purpose of the processing]. Categories of Personal Data: [Categories of personal data]. Sensitive personal data, and the safeguards applied: none. Categories of data subjects: [Categories of data subjects]. Processing outside the UAE and the basis for each transfer: none. Controller privacy contact: [Controller privacy contact (and DPO, if any)]. Processor privacy contact: [Processor privacy contact (and DPO, if any)].

Security Measures

The Processor must implement at least the following technical and organisational measures: access to Personal Data limited to personnel who need it, with unique user accounts and multi-factor authentication for administrative and remote access; encryption of Personal Data in transit over public networks and at rest where appropriate to the risk; logging and monitoring of access to systems that hold Personal Data; vulnerability management, patching and malware protection; backups and tested recovery procedures; a documented incident-response procedure; confidentiality undertakings and data protection training for personnel; physical security for premises and equipment used for the processing; and regular testing and evaluation of the effectiveness of these measures.

Approved Sub-processors

Sub-processors approved at the date of this agreement (name, location and processing performed): none.