International Data Processing Agreement

Definitions

"Personal Data" means any personal data that the Processor processes on behalf of the Controller in connection with the Main Agreement.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

"Sub-processor" means any processor engaged by the Processor to process Personal Data.

"EU GDPR" means Regulation (EU) 2016/679, and "UK GDPR" has the meaning given in the UK Data Protection Act 2018. Other terms defined in Data Protection Laws and used in this agreement, including "personal data", "processing", "data subject", "controller", "processor" and "supervisory authority", have the same meanings here.

Roles and Scope

For the Personal Data, the Controller is the controller and the Processor is the processor. Where the Controller is itself a processor for another controller, the Processor acts as its Sub-processor and the Controller's instructions include those it receives from that controller. This agreement forms part of the Main Agreement and applies for as long as the Processor processes Personal Data. The Processing Details schedule sets out the subject matter and duration of the processing, its nature and purpose, the types of Personal Data and the categories of data subjects.

Controller Responsibilities

The Controller is responsible for having a lawful basis for the processing and for giving data subjects the information Data Protection Laws require. Its instructions must comply with Data Protection Laws. Before the processing starts, and whenever the risk changes, the Controller must tell the Processor about any sensitive or special category data and any other risk to individuals that the Processor needs to know to protect the Personal Data.

Processing Instructions

The Processor must process Personal Data only on the Controller's documented instructions, including with regard to international transfers, unless applicable law requires it to do otherwise. In that case the Processor must tell the Controller of that legal requirement before processing, unless that law prohibits this on important grounds of public interest. The Controller's instructions are this agreement, the Main Agreement and any further written instructions it gives that are consistent with them.

The Processor must immediately tell the Controller if, in its opinion, an instruction infringes Data Protection Laws. The Processor may suspend the affected processing until the Controller confirms, changes or withdraws the instruction. If the Controller maintains an instruction that the Processor reasonably considers unlawful, either party may terminate the affected services on written notice.

Confidentiality

The Processor must ensure that each person it authorises to process Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to perform the Main Agreement.

Security

The Processor must implement and maintain the measures in the Security Measures schedule and any other technical and organisational measures Data Protection Laws require to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risk to individuals. The Processor must regularly test and review those measures. It may update them, provided no update materially reduces the overall level of protection.

Sub-processors

The Controller gives general written authorisation for the Processor to engage the Sub-processors listed in the Approved Sub-processors schedule and others notified under this clause. The Processor must notify the Controller in writing of any intended addition or replacement at least 30 days before it takes effect, identifying the Sub-processor, its location and the processing it will perform. The Controller may object on reasonable data protection grounds within that period, and the parties must then discuss the objection in good faith. If it is not resolved before the change takes effect, the Controller may terminate the affected services on written notice and receive a refund of charges prepaid for the period after termination.

Before a Sub-processor processes Personal Data, the Processor must bind it by a written contract imposing the same data protection obligations as this agreement, in particular sufficient guarantees of appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of each Sub-processor's obligations. On request, the Processor must give the Controller a copy of the relevant data protection terms, which may be redacted to protect confidential commercial information.

Assistance

Taking into account the nature of the processing, the Processor must assist the Controller by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights under Data Protection Laws. If the Processor receives such a request directly, it must forward it to the Controller within 5 working days and must not respond except on the Controller's documented instructions or as the law requires.

Taking into account the nature of the processing and the information available to it, the Processor must assist the Controller in meeting its obligations under Data Protection Laws on security of processing, notifying Personal Data Breaches to supervisory authorities and data subjects, data protection impact assessments, transfer impact assessments and prior consultation with supervisory authorities. The Controller must pay the Processor's reasonable charges, agreed in advance, for assistance beyond the services under the Main Agreement, unless the assistance is needed because of the Processor's breach of this agreement.

Personal Data Breaches

The Processor must notify the Controller of a Personal Data Breach without undue delay, and in any event within 48 hours, after becoming aware of it. The notice must describe, so far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact point for more information. The Processor must give further information in phases, without undue delay, as it becomes available.

The Processor must promptly take reasonable steps to contain, investigate and mitigate a Personal Data Breach and must cooperate with the Controller's response. Unless the law requires otherwise, the Processor must not notify any supervisory authority, data subject or other third party of a Personal Data Breach without the Controller's prior written approval. A notification or response by the Processor is not an admission of fault or liability.

International Transfers

The Processor must not transfer Personal Data to another country or an international organisation, including by allowing access from another country, except on the Controller's documented instructions and in compliance with Data Protection Laws. The Controller instructs transfers to the processing locations in the Processing Details schedule and to Sub-processors authorised under the Sub-processors clause at their notified locations. Where Data Protection Laws restrict a transfer, the parties must put in place the standard contractual clauses or other model transfer terms approved under Data Protection Laws before it takes place, and the exporter must carry out any transfer impact assessment those laws require, with the importer's reasonable cooperation. The Processor must tell the Controller without undue delay if it can no longer comply with this clause.

By signing this agreement, the parties enter into the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") for each transfer of Personal Data from the Controller to the Processor that the EU GDPR restricts. Module Two applies where the Controller is a controller and Module Three where it is a processor. The optional docking clause does not apply. In Clause 9, Option 2 applies with the notice period in the Sub-processors clause, or Option 1 where that clause requires specific authorisation. The optional wording in Clause 11 does not apply. In Clause 17, Option 1 applies with the law of Ireland, and under Clause 18 its courts are chosen. The parties' details, the Processing Details, Security Measures and Approved Sub-processors schedules complete Annexes I to III, and Annex I.C names the supervisory authority determined under Clause 13. The EU SCCs prevail over this agreement if they conflict.

Where another transfer mechanism requires the parties to sign model clauses or an addendum, they must do so in its official form, completed from the schedules to this agreement. For a transfer that the UK GDPR restricts, these are the International Data Transfer Addendum to the European Commission's standard contractual clauses or the International Data Transfer Agreement, in the current version issued under section 119A of the UK Data Protection Act 2018. Those terms prevail over this agreement if they conflict.

Information and Audit

The Processor must make available to the Controller all information necessary to demonstrate compliance with this agreement and the processor obligations in Data Protection Laws, and must allow for and contribute to audits, including inspections, by the Controller or an independent auditor it mandates. The Controller must give at least 30 days written notice, and audits may take place no more than once in any 12-month period unless a Personal Data Breach, a supervisory authority or reasonable evidence of non-compliance requires otherwise. The Controller must take account of current independent audit reports or certifications the Processor provides when deciding the audit's scope. Audits must take place during business hours, with minimal disruption and under reasonable confidentiality and security conditions. Each party bears its own costs, unless the audit reveals a material breach by the Processor, which must then reimburse the Controller's reasonable audit costs and promptly remedy the breach.

Return and Deletion

When the provision of services relating to the processing ends, the Processor must, at the Controller's choice, delete or return all Personal Data to the Controller within 30 days and delete existing copies, unless applicable law requires storage. If the Controller does not choose within that period, the Processor must delete it. Personal Data the Processor must store remains protected under this agreement, may be processed only for the purpose requiring storage, and must be deleted when that requirement ends. On request, the Processor must confirm deletion in writing.

Liability

Each party's liability arising out of or in connection with this agreement is subject to the limitations and exclusions of liability in the Main Agreement, and claims under this agreement and the Main Agreement count together towards any cap. Nothing in this agreement limits or excludes liability to data subjects under Data Protection Laws or a transfer mechanism, or any liability that cannot be limited or excluded by law.

Term and Termination

This agreement continues until the Processor has stopped processing Personal Data and has returned or deleted it under the Return and Deletion clause. If the Processor breaches this agreement or Data Protection Laws, the Controller may instruct it to suspend the affected processing until the breach is remedied. The Controller may terminate the affected services under the Main Agreement on written notice if the Processor commits a material breach of this agreement that cannot be remedied or is not remedied within 30 days after written notice.

General

If this agreement conflicts with the Main Agreement on the processing of Personal Data, this agreement prevails, and any transfer terms entered into under the International Transfers clause prevail over both. Notices under this agreement are given as the Main Agreement provides, but Personal Data Breach notifications and data subject requests may also be sent to the privacy contacts in the Processing Details schedule.

If a change in Data Protection Laws, or guidance or a decision of a supervisory authority or court, requires a change to this agreement or to a transfer mechanism, the parties must negotiate in good faith and agree the minimum change needed.

No person other than the parties may enforce this agreement, except a data subject to the extent Data Protection Laws or a transfer mechanism gives it that right.

Governing Law and Disputes

This agreement and any non-contractual obligations arising out of or in connection with it are governed by the law that governs the Main Agreement or, if it specifies none, the law of England and Wales. Any dispute arising out of or in connection with this agreement must be resolved by the courts or arbitral tribunal having jurisdiction under the Main Agreement or, if it specifies none, arbitration in London under the LCIA Rules. This does not affect any jurisdiction that Data Protection Laws or a transfer mechanism gives to a supervisory authority, a court or a data subject.