DIFC Data Processing Agreement

Roles and Scope

For the Personal Data, the Controller is the controller and the Processor is the processor. The Processor confirms that it can provide sufficient assurances that it will implement appropriate technical and organisational measures so that the Processing meets the Data Protection Law and protects Data Subjects' rights. This agreement forms part of the Main Agreement and applies for as long as the Processor processes Personal Data. The Processing Details schedule sets out the subject matter and duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects.

Controller Responsibilities

The Controller is responsible for the lawfulness of the Processing and for giving Data Subjects the information the Data Protection Law requires. Its instructions must comply with the Data Protection Law. The Controller must tell the Processor about any Special Categories of Personal Data and any other risk to Data Subjects the Processor needs to know to protect the Personal Data.

Processing Instructions

The Processor must process Personal Data only on the Controller's documented instructions, including with regard to sharing Personal Data in response to a Requesting Authority's request and transfers to a Third Country or an international organisation, unless Applicable Law to which the Processor is subject requires otherwise. In that case the Processor must inform the Controller, unless that law prohibits this on grounds of substantial public interest. The Controller's instructions are this agreement, the Main Agreement and any further written instructions it gives that are consistent with them.

The Processor must immediately inform the Controller whether, in its opinion, any Processing activity or instruction infringes the Data Protection Law. The Processor may suspend the affected Processing until the Controller confirms, changes or withdraws the instruction. If the Processor determines the purposes and means of any Processing in breach of this agreement, it is treated as a controller for that Processing.

Confidentiality

The Processor must ensure that each person authorised to process Personal Data is bound by a legally binding written agreement or duty of confidentiality and processes Personal Data only on the Controller's instructions, unless Applicable Law requires otherwise.

Security

The Processor must implement and maintain the measures in the Security Measures schedule and any other technical and organisational measures the Data Protection Law requires, appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing and the risks to Data Subjects. The Processor must regularly test and review those measures and may update them, provided no update materially reduces the overall level of protection.

Sub-processors

The Controller, having satisfied itself that conditions are in place for Sub-processors to provide the assurances the Data Protection Law requires, gives general written authorisation for the Processor to engage the Sub-processors in the Approved Sub-processors schedule and others notified under this clause. The Processor must inform the Controller in writing of any intended addition or replacement at least 30 days in advance, identifying the Sub-processor, its location and the Processing it will perform, and must take into account any good faith objection. If an objection is not resolved before the change takes effect, the Controller may terminate the affected services on written notice without liability for charges for the period after termination.

Before a Sub-processor processes Personal Data, the Processor must enter into a legally binding written agreement with it that contains the commitments in this agreement and fully delegates the obligations the Processor owes the Controller for that Processing. The Processor remains fully liable to the Controller for the performance of each Sub-processor's obligations.

Assistance

Taking into account the nature of the Processing, the Processor must assist the Controller by appropriate technical and organisational measures to respond to requests from Data Subjects exercising their rights. Unless Applicable Law requires otherwise, the Processor must not respond to a Data Subject directly and must promptly forward the request to the Controller's privacy contact.

Taking into account the nature of the Processing and the information available to it, the Processor must assist the Controller in complying with its obligations on security, data protection impact assessments, prior consultation with the Commissioner and notifying Personal Data Breaches to the Commissioner and Data Subjects. The Controller must pay the Processor's reasonable charges, agreed in advance, for assistance beyond the services under the Main Agreement, unless the assistance is needed because of the Processor's breach of this agreement.

Requests from Authorities

If the Processor receives a request from a Requesting Authority for the disclosure or transfer of Personal Data, it must, where Applicable Law allows, give the Controller reasonable notice before disclosing. It may disclose only after taking reasonable steps to satisfy itself that the request is valid and proportionate and that the Requesting Authority will respect Data Subjects' rights. It must limit any disclosure to what the request requires, redact or minimise Personal Data where possible, and where reasonably practicable obtain written assurances from the Requesting Authority.

Personal Data Breaches

The Processor must notify the Controller's privacy contact of a Personal Data Breach without undue delay, and in any event within 48 hours, after becoming aware of it. The notice must describe, so far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences, the measures taken or proposed and a contact point, with further information provided in phases as it becomes available. The Processor must cooperate fully with any investigation by the Commissioner and must not notify any third party of the breach without the Controller's approval unless the law requires it.

Information and Audit

The Processor must make available to the Controller, and to the Commissioner on request, all information necessary to demonstrate compliance with Article 24 of the Data Protection Law and this agreement, and must permit and reasonably assist with audits, including inspections, by the Controller, an auditor it mandates or the Commissioner. Audits by or for the Controller require at least 30 days written notice and may take place no more than once in any 12-month period, unless a Personal Data Breach or a reasonable indication of material non-compliance justifies more. They must take place during business hours, with minimal disruption and subject to reasonable confidentiality and security requirements, and the Controller must take account of current independent audit reports or certifications. Each party bears its own costs unless the audit reveals a material breach by the Processor.

International Transfers

The Processor must not transfer Personal Data to a Third Country, which includes elsewhere in the UAE, or to an international organisation, including by allowing access from there, except on the Controller's documented instructions and in compliance with Articles 26 and 27 of the Data Protection Law. The Controller instructs transfers to the locations in the Processing Details schedule and to Sub-processors authorised under the Sub-processors clause at their notified locations.

Where a transfer is to a jurisdiction the Commissioner has not found adequate, the parties must, before it takes place, put in place an appropriate safeguard under Article 27(2) of the Data Protection Law, such as the standard contractual clauses adopted by the Commissioner, completed from the schedules to this agreement, and must ensure enforceable Data Subject rights and effective legal remedies are available. The Processor must ensure the same for any transfer to or by a Sub-processor.

Return and Deletion

When the provision of services relating to the Processing ends, the Processor must, at the Controller's option, delete or return all Personal Data to the Controller, or make it available for return, within 30 days, and delete existing copies unless Applicable Law requires storage. Personal Data the Processor must store remains protected under this agreement and may be processed only for the purpose requiring storage. On request, the Processor must confirm deletion in writing.

Liability

Each party's liability arising out of or in connection with this agreement is subject to the limitations and exclusions of liability in the Main Agreement, and claims under both count together towards any cap. Nothing in this agreement limits either party's liability to Data Subjects under Article 64A of the Data Protection Law or any liability that cannot lawfully be limited or excluded.

Term and Termination

This agreement continues until the Processor has stopped processing Personal Data and has returned or deleted it under the Return and Deletion clause. If the Processor breaches this agreement or the Data Protection Law, the Controller may instruct it to suspend the affected Processing until the breach is remedied, and may terminate the affected services under the Main Agreement on written notice if the breach is material and cannot be remedied or is not remedied within a reasonable period after written notice.

General

If this agreement conflicts with the Main Agreement on the Processing of Personal Data, this agreement prevails, and any transfer clauses entered into under the International Transfers clause prevail over both. Notices are given as the Main Agreement provides, but Personal Data Breach notifications and Data Subject requests may also be sent to the privacy contacts in the Processing Details schedule.

Governing Law and Jurisdiction

This agreement and any non-contractual obligations arising out of or in connection with it are governed by the laws of the Dubai International Financial Centre. The DIFC Courts have exclusive jurisdiction to settle any dispute arising out of or in connection with this agreement.