DATA PROCESSING AGREEMENT
This data processing agreement (hereinafter the "Agreement") has been entered into in [Place of signing] on [Date of the agreement] between the following parties:
1. PARTIES
1.1 [Name of the controller]
Registry code: [Registry code of the controller]
Address: [Address of the controller]
(hereinafter the "Controller")
1.2 [Name of the processor]
Registry code: [Registry code of the processor]
Address: [Address of the processor]
(hereinafter the "Processor")
2. ROLES OF THE PARTIES AND RELATIONSHIP OF THE AGREEMENT TO THE MAIN CONTRACT
2.1 The Controller determines the purposes and means of the processing of personal data.
2.2 The Processor processes personal data only on the basis of documented instructions from the Controller and does not use them for its own purposes.
2.3 This Agreement is an annex to the main service contract entered into between the parties (hereinafter the "Main Contract") and does not amend its terms. In matters of personal data processing, the Agreement prevails in the event of a conflict between the Agreement and the Main Contract.
2.4 The terms used in the Agreement (e.g. personal data, processing, data subject, personal data breach) have the meaning set out in Article 4 of the General Data Protection Regulation (EU) 2016/679 (hereinafter the "GDPR").
2.5 The Agreement is valid during the term of the Main Contract and for as long as the Processor processes personal data on behalf of the Controller.
3. SUBJECT MATTER, NATURE AND PURPOSE OF THE PROCESSING
3.1 Main service in the provision of which personal data are processed:
[Main service under which the data are processed]
3.2 Purpose of the processing:
[Purpose of the processing]
3.3 The nature of the processing comprises the collection, recording, storage, structuring, use, transmission to the Controller and erasure of personal data to the extent necessary for providing the main service specified in clause 3.1.
3.4 The duration of the processing corresponds to the term of the Agreement specified in clause 2.5, plus the time for return and erasure specified in clause 12.
4. DATA PROCESSED
4.1 Categories of personal data processed: [Categories of data processed]
4.2 Categories of data subjects: [Categories of data subjects]
4.3 The Processor does not process other categories of personal data or personal data of other data subjects unless the Controller has provided for this by a documented instruction.
4.4 The processing includes special categories of personal data (GDPR Article 9), which require stricter safeguards and restricted access.
5. RIGHTS AND OBLIGATIONS OF THE CONTROLLER
5.1 The Controller ensures that it has a legal basis for the processing of personal data and that the data subjects have been informed of the processing.
5.2 The Controller gives instructions in writing or in a form reproducible in writing. The Agreement and the Main Contract are deemed documented instructions of the Controller.
5.3 The Controller is entitled to receive information on the performance of the Agreement and to verify the compliance of the Processor's activities with the Agreement in accordance with the procedure set out in clause 11.
6. OBLIGATIONS OF THE PROCESSOR
6.1 The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information (GDPR Article 28(3)(a)).
6.2 The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions (GDPR Article 28(3)).
6.3 The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (GDPR Article 28(3)(b)).
6.4 The Processor takes all security measures required pursuant to Article 32 of the GDPR, as described in more detail in clause 7.
6.5 The Processor assists the Controller by appropriate technical and organisational measures in fulfilling the obligation to respond to requests for exercising the data subject's rights. If the Processor receives a request directly from a data subject, it forwards the request to the Controller without delay and does not respond to it itself without the Controller's instruction (GDPR Article 28(3)(e)).
6.6 Taking into account the nature of processing and the information available to the Processor, the Processor assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, including the obligations relating to security of processing, notification of breaches, data protection impact assessment and prior consultation (GDPR Article 28(3)(f)).
6.7 The Processor maintains a record of the processing activities carried out on behalf of the Controller where required by Article 30(2) of the GDPR.
6.8 The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in the Agreement and in Article 28 of the GDPR (GDPR Article 28(3)(h)).
6.9 The Processor cooperates with the supervisory authority on request and notifies the Controller without delay of any enquiry by the supervisory authority or another public authority concerning the personal data processed on behalf of the Controller, unless prohibited by law.
7. SECURITY MEASURES
7.1 The Processor implements at least the following measures: restriction and regular review of access rights, encryption of data in transit, making backup copies, logging of access and instruction of employees.
7.2 The Processor implements technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk to the rights and freedoms of data subjects. The measures include, as appropriate, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident, and regular testing and evaluation of the effectiveness of the measures (GDPR Article 32(1)).
7.3 The Processor does not reduce the agreed level of security without the prior consent of the Controller. A more detailed description of the security measures may be added as an annex to the Agreement.
8. SUB-PROCESSORS
8.1 The Processor may engage sub-processors, notifying the Controller thereof in writing at least [Advance notice of a sub-processor (days)] days in advance.
8.2 The Controller is entitled to submit a reasoned objection to the engagement. Until the objection has been resolved, the Processor does not engage the sub-processor in the processing of the Controller's personal data.
8.3 The Processor ensures by contract that the same data protection obligations as agreed in this Agreement apply to the sub-processor, in particular sufficient guarantees to implement appropriate technical and organisational measures (GDPR Article 28(4)).
8.4 The Processor is liable for the activities of the sub-processor as for its own activities and remains fully liable to the Controller for the performance of the sub-processor's obligations (GDPR Article 28(4)).
8.5 The Processor maintains an up-to-date list of the sub-processors processing the Controller's personal data and submits it to the Controller on request.
9. TRANSFER OF DATA
9.1 Personal data are not transferred outside the European Economic Area.
9.2 The transfer of personal data outside the European Economic Area, including enabling remote access to them, requires the prior written consent of the Controller and an amendment of the Agreement.
10. NOTIFICATION OF BREACHES
10.1 The Processor notifies the Controller of a personal data breach without undue delay, but no later than within [Deadline for notifying a breach (hours)] hours after becoming aware of the breach (GDPR Article 33(2)).
10.2 The notification contains a description of the breach, the categories and approximate number of data and data subjects concerned, the contact details of a contact point for obtaining information, a description of the likely consequences of the breach and the measures taken or proposed, including measures to mitigate its possible adverse effects (GDPR Article 33(3)). Where it is not possible to provide all the information at the same time, it is provided in phases without undue further delay.
10.3 The Processor takes measures without delay to mitigate the consequences of the breach, documents the breach and assists the Controller in notifying the supervisory authority and the data subjects. The Processor does not notify the data subjects or the public of the breach without the Controller's instruction, unless otherwise provided by law.
11. AUDIT
11.1 The Controller is entitled to verify the Processor's compliance with this Agreement by giving reasonable advance notice thereof.
11.2 The verification may be carried out by the Controller or an auditor mandated by it, including on site. The Processor contributes to the audit and allows access to the relevant documents, systems and premises. The audit is carried out during working hours and in a manner that does not unreasonably interfere with the Processor's activities, and the information that becomes known during the audit is confidential.
12. TERMINATION OF THE AGREEMENT
12.1 Upon the termination of the Agreement, the Processor erases all personal data within [Erasure deadline after the end of the agreement (days)] days.
12.2 The obligation to erase also covers copies of personal data, including copies in the possession of sub-processors (GDPR Article 28(3)(g)).
12.3 The obligation to erase does not extend to data whose retention is required by legislation. Such data are processed solely for the purpose of retention and remain protected by the terms of the Agreement.
12.4 At the Controller's request, the Processor confirms in writing the return or erasure of the personal data.
13. LIABILITY
13.1 The Parties are liable in accordance with the law for damage caused to the other Party by a breach of the Agreement. Liability for damage caused to a data subject is determined on the basis of Article 82 of the GDPR.
13.2 If the Processor, in infringement of the GDPR, determines the purposes and means of processing personal data itself, it is considered to be a controller in respect of that processing (GDPR Article 28).
14. FINAL PROVISIONS
14.1 Amendments and supplements to the Agreement are made in writing or in a form reproducible in writing and enter into force once both Parties have confirmed them.
14.2 The confidentiality and data protection obligations also remain in force after the termination of the Agreement for as long as the Processor holds personal data of the Controller.
14.3 If any provision of the Agreement is or becomes invalid, this does not affect the validity of the remaining provisions.
15. LEGAL BASIS
15.1 The Agreement is governed by the General Data Protection Regulation and the Estonian Personal Data Protection Act. The Agreement has been entered into in order to comply with the content requirements for a contract with a processor laid down in Article 28(3) of the GDPR.
15.2 The Agreement is governed by the law of [Governing law].