UAE Mainland Data Processing Agreement

Roles and Scope

For the Personal Data, the Controller is the controller and the Processor is the processor. The Processor confirms that it has sufficient guarantees to implement technical and organisational measures so that the processing meets the requirements of the Data Protection Law. This agreement forms part of the Main Agreement. The Processing Details schedule sets out the subject matter, processing period, nature and purpose of the processing and the categories of Personal Data and data subjects.

Controller Responsibilities

The Controller is responsible for the lawful basis of the processing, including any consent the Data Protection Law requires, and for giving data subjects the required information. Its instructions must comply with the Data Protection Law. The Controller must report Personal Data Breaches to the Data Office and data subjects where the Data Protection Law requires.

Processing Instructions

The Processor must process Personal Data only in accordance with the Controller's instructions and this agreement, only for the purpose and during the processing period in the Processing Details schedule, and in accordance with the Data Protection Law and any instructions of the Data Office. The Controller's instructions are this agreement, the Main Agreement and any further written instructions it gives that are consistent with them.

If the Processor reasonably believes that an instruction breaches the Data Protection Law, it must promptly tell the Controller and may suspend the affected processing until the Controller confirms, changes or withdraws the instruction.

Confidentiality

The Processor must not do anything that would disclose Personal Data or the results of the processing, except as this agreement or the law permits. It must ensure that each person it authorises to process Personal Data is bound by confidentiality obligations and has access only where needed for the purpose.

Security

The Processor must apply appropriate technical and organisational measures to protect Personal Data, from the design stage of the processing, including the measures in the Security Measures schedule, and must protect and secure the processing and the electronic media and devices used for it. The measures must take account of the nature, scope and purposes of the processing, the risks to data subjects, available technology and cost. The Processor may update them, provided no update materially reduces the overall level of protection.

Personal Data Breaches

The Processor must notify the Controller of a Personal Data Breach as soon as it becomes aware of it, and in any event within 24 hours. It must give the information then available about the breach, the Personal Data and data subjects affected, the likely consequences and the measures taken or proposed, update the Controller as more becomes known, take prompt steps to contain and remedy the breach, and cooperate with any investigation by the Data Office. It must not notify any third party without the Controller's approval unless the law requires it.

Assistance

If the Processor receives a request from a data subject about Personal Data, it must promptly forward it to the Controller and must not respond except on the Controller's written instructions or as the Data Protection Law requires. Taking into account the nature of the processing, the Processor must reasonably assist the Controller to respond to requests from data subjects to exercise their rights.

Taking into account the nature of the processing and the information available to it, the Processor must reasonably assist the Controller to comply with the Data Protection Law on security, Personal Data Breaches, impact assessments and enquiries from the Data Office. The Controller must reimburse the Processor's reasonable documented costs of assistance beyond the ordinary scope of the services, unless the need arose from the Processor's breach of this agreement or the Data Protection Law.

Authority Requests

Unless the law prohibits it, the Processor must promptly tell the Controller of any legally binding request, inspection or other contact from the Data Office or another competent authority concerning Personal Data, cooperate with the Controller's response and disclose Personal Data only to the extent legally required.

Sub-processors

The Processor may engage the sub-processors listed in the Approved Sub-processors schedule. It must notify the Controller in writing at least 30 days before engaging or replacing any other sub-processor, identifying it, its location and the processing it will perform, and the Controller may object on reasonable data protection grounds within that period. If an objection is not resolved, the Controller may terminate the affected services without penalty.

The Processor must engage each sub-processor under a written contract that clearly defines its obligations and imposes obligations no less protective than this agreement. The Processor remains responsible to the Controller for each sub-processor's acts and omissions in the processing.

International Transfers

The Processor must not transfer Personal Data outside the UAE, or allow access to it from outside the UAE, except on the Controller's instructions, as recorded in the Processing Details schedule, and in compliance with the Data Protection Law. A transfer may be made only to a country whose legislation on personal data protection the Data Protection Law treats as adequate or, failing that, on a basis the Data Protection Law permits, such as a contract binding the recipient to apply the requirements and measures of the Data Protection Law. The Processor must tell the Controller without undue delay if it can no longer meet these conditions.

Records and Information

The Processor must keep a record of the Personal Data it processes on behalf of the Controller, as the Data Protection Law requires, and give it to the Controller or the Data Office on request. It must provide the Controller with the information and means reasonably needed to prove its compliance with this agreement and the Data Protection Law.

Audit

The Controller, or an independent auditor bound by confidentiality, may audit the Processor's compliance with this agreement on at least 30 days written notice and no more than once in any 12-month period, except after a Personal Data Breach or where the Data Office requires. Audits must take place during business hours, minimise disruption and follow the Processor's reasonable security rules. The Processor may meet a request with current independent audit reports or certifications where they reasonably demonstrate compliance.

Return and Erasure

When the processing period ends, or earlier when the Processor hands the Personal Data over to the Controller, the Processor must return any Personal Data the Controller requests and erase all Personal Data, including copies held by sub-processors, within 30 days, unless the law requires it to keep it. Personal Data it must keep remains protected under this agreement and may be processed only for that legal purpose. On request, the Processor must confirm erasure in writing.

Liability

The limitations and exclusions of liability in the Main Agreement apply to this agreement, and claims under both count together towards any cap. Nothing in this agreement limits liability to the extent it cannot lawfully be limited.

Term and Priority

This agreement takes effect on its date and continues until the Processor has returned and erased the Personal Data under the Return and Erasure clause. If it conflicts with the Main Agreement on the processing of Personal Data, this agreement prevails. Notices are given as the Main Agreement provides, but Personal Data Breach notices and data subject requests may also be sent to the privacy contacts in the Processing Details schedule.

Language

This agreement is made in English. If it is translated into Arabic, including for proceedings before a UAE court, the English text prevails between the parties to the extent the law allows.

Governing Law and Disputes

This agreement is governed by the federal laws of the United Arab Emirates and, where applicable, the laws of the Emirate of Dubai. The parties submit to the exclusive jurisdiction of the courts of the Emirate of Dubai for any dispute arising out of or in connection with it.