��������Ƶ

A Data Processing Agreement is essential when one organization (the processor) processes personal information on behalf of another organization (the controller) in New Zealand. This document is required to comply with the Privacy Act 2020 and ensures appropriate safeguards are in place for handling personal information. It becomes particularly important when organizations outsource data processing activities, use cloud services, or engage third-party service providers. The agreement details security measures, breach notification procedures, cross-border transfer requirements, and sub-processing arrangements. It should be used whenever there is any systematic processing of personal information by a third party, regardless of the scale of processing. The document helps organizations demonstrate compliance with privacy principles and establishes clear lines of responsibility and accountability between parties.

1. Parties: Identification of the data controller and data processor, including their full legal names, registration numbers, and registered addresses

2. Background: Context of the agreement, relationship between the parties, and purpose of the data processing activities

3. Definitions: Key terms used in the agreement, including 'Personal Information' (NZ terminology), 'Processing', 'Data Subject', 'Sub-processor', and other relevant terms

4. Scope and Purpose of Processing: Detailed description of the data processing activities, types of personal information involved, and purposes for which data may be processed

5. Obligations of the Data Controller: Responsibilities of the data controller, including providing lawful instructions and ensuring legal basis for processing

6. Obligations of the Data Processor: Core processor obligations including processing only on documented instructions, maintaining confidentiality, and implementing security measures

7. Security Measures: Technical and organizational security measures required to protect personal information

8. Sub-processing: Conditions and requirements for engaging sub-processors, including authorization process and flow-down obligations

9. Data Subject Rights: Procedures for assisting the controller in responding to data subject rights requests under the Privacy Act

10. Data Breach Notification: Procedures and timeframes for notifying the controller of privacy breaches as required by the Privacy Act

11. Audit Rights: Controller's rights to audit the processor's compliance and processor's obligations to demonstrate compliance

12. Cross-border Data Transfers: Rules and safeguards for transferring personal information outside New Zealand

13. Term and Termination: Duration of the agreement and circumstances under which it can be terminated

14. Return or Deletion of Data: Obligations regarding personal information upon termination of services

15. General Provisions: Standard contractual provisions including governing law, jurisdiction, and dispute resolution