FREE POPIA TOOLKIT
SUPPORTING TEMPLATE
Data Processing Agreement
1. Parties
This Data Processing Agreement (“Agreement”) is entered into on [Insert Date] between:
[Insert Name of Data Controller], a company registered under the laws of [Insert Country], with its registered office at [Insert Address] (“Data Controller”), and
[Insert Name of Data Processor], a company registered under the laws of [Insert Country], with its registered office at [Insert Address] (“Data Processor”).
Collectively referred to as the “Parties” and individually as a “Party”.
2. Background
2.1 The Data Controller is responsible for processing personal information in accordance with applicable data protection laws and regulations.
2.2 The Data Processor provides services to the Data Controller that involve the processing of personal information on behalf of the Data Controller.
3. Purpose
The purpose of this Agreement is to set out the terms and conditions governing the processing of personal information by the Data Processor on behalf of the Data Controller.
4. Scope
4.1 The Data Processor agrees to process personal information on behalf of the Data Controller for the following purposes: [Insert Purpose(s)].
4.2 The Data Processor shall only process personal information in accordance with the instructions provided by the Data Controller and shall not use the personal information for any other purpose.
5. Responsibilities
5.1 Data Controller Responsibilities:
- Provide clear and lawful instructions for the processing of personal information.
- Ensure that the personal information provided to the Data Processor is accurate and up to date.
- Monitor the Data Processor’s compliance with this Agreement.
5.2 Data Processor Responsibilities:
- Process personal information only on behalf of and in accordance with the instructions of the Data Controller.
- Implement appropriate technical and organizational measures to ensure the security of personal information.
- Assist the Data Controller in responding to data subject requests and inquiries.
6. Security Measures
The Data Processor shall implement appropriate technical and organizational measures to ensure the security of personal information, including but not limited to:
- Encryption of personal information.
- Access controls and authentication mechanisms.
- Regular security audits and assessments.
7. Data Subject Rights
The Data Processor shall assist the Data Controller in responding to data subject requests to exercise their rights under applicable data protection laws and regulations.
8. Subprocessing
The Data Processor shall not subcontract any of its processing activities to a third party without the prior written consent of the Data Controller.
9. Data Breach Notification
In the event of a personal data breach, the Data Processor shall notify the Data Controller without undue delay and provide assistance as necessary to mitigate the impact of the breach.
10. Term and Termination
This Agreement shall remain in effect for the duration of the data processing activities and may be terminated by either Party in accordance with the terms of this Agreement.
11. Governing Law
This Agreement shall be governed by and construed in accordance with the laws of [Insert Governing Law].
12. Entire Agreement
This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements and understandings, whether written or oral.
IN WITNESS WHEREOF, the Parties have executed this Agreement as of the date first above written.
[Signature of Data Controller]
Name: [Print Name]
Title: [Title]
Date: [Date]
[Signature of Data Processor]
Name: [Print Name]
Title: [Title]
Date: [Date]
This Data Processing Agreement establishes the terms and conditions governing the processing of personal information by a Data Processor on behalf of a Data Controller, ensuring compliance with data protection laws and regulations, including the Protection of Personal Information Act (POPIA) in South Africa.
