# Data Processing Agreement

**Between:**

**Controller:** Summit Cloud Partners, [Registered Address], [Registration Number]
(hereinafter "the Controller")

**and**

**Processor:** [Vendor Legal Name], [Registered Address], [Registration Number]
(hereinafter "the Processor")

Collectively referred to as "the Parties."

**Effective Date:** [Date]

---

## 1. Definitions

In this Agreement, unless the context requires otherwise:

- **"Personal Data"**, **"Processing"**, **"Controller"**, **"Processor"**, **"Data Subject"**, **"Personal Data Breach"**, and **"Supervisory Authority"** have the meanings given in the GDPR.
- **"GDPR"** means Regulation (EU) 2016/679.
- **"Documented Instructions"** means written instructions from the Controller to the Processor regarding the Processing of Personal Data, as set out in this Agreement or provided subsequently in writing.
- **"Sub-Processor"** means any processor engaged by the Processor to carry out specific Processing activities on behalf of the Controller.
- **"MSA"** means the Master Services Agreement between the Parties dated [Date].

## 2. Subject-Matter and Duration of Processing

2.1 This Agreement governs the Processing of Personal Data by the Processor on behalf of the Controller in connection with the services described in the MSA.

2.2 The subject-matter of Processing is: [As described in Annex I].

2.3 The duration of Processing shall be co-terminus with the MSA, plus a period of [90] calendar days for data return and certified deletion.

2.4 Sections [confidentiality, deletion certification, audit rights] shall survive termination of this Agreement for a period of [3] years.

## 3. Nature and Purpose of Processing

3.1 The nature of Processing operations performed by the Processor is described in Annex I.

3.2 The purpose of Processing is: [As described in Annex I].

3.3 The Processor shall not Process Personal Data for any purpose other than as specified in Annex I and the Controller's Documented Instructions.

## 4. Type of Personal Data

4.1 The categories of Personal Data Processed under this Agreement are set out in Annex I.

4.2 The Processor shall immediately inform the Controller if it becomes aware that it has received Personal Data outside the categories specified in Annex I.

## 5. Categories of Data Subjects

5.1 The categories of Data Subjects whose Personal Data is Processed under this Agreement are set out in Annex I.

## 6. Controller Obligations and Rights

6.1 The Controller shall:
  (a) Determine the lawful basis for Processing under Article 6 GDPR;
  (b) Provide Documented Instructions to the Processor regarding the Processing;
  (c) Be responsible for responding to Data Subject requests, with the assistance of the Processor;
  (d) Notify the Processor of any changes to Processing Instructions or applicable regulatory requirements;
  (e) Conduct due diligence on the Processor prior to and during the term of this Agreement.

6.2 The Controller has the right to:
  (a) Issue and modify Documented Instructions;
  (b) Audit the Processor's compliance with this Agreement;
  (c) Object to changes in Sub-Processors;
  (d) Require data return or deletion upon termination.

## 7. Processor Obligations

### 7.1 Documented Instructions [Article 28(3)(a)]

The Processor shall Process Personal Data only on Documented Instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organisation. If the Processor is required by Union or Member State law to Process Personal Data beyond the Controller's instructions, the Processor shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

### 7.2 Confidentiality [Article 28(3)(b)]

The Processor shall ensure that all persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

### 7.3 Security Measures [Article 28(3)(c)]

The Processor shall implement the technical and organisational measures set out in Annex II. These measures include, as appropriate:
  (a) Pseudonymisation and encryption of Personal Data;
  (b) The ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services;
  (c) The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
  (d) A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing.

### 7.4 Sub-Processors [Article 28(3)(d)]

7.4.1 The Controller grants the Processor general written authorisation to engage Sub-Processors, subject to the conditions in this Section.

7.4.2 The Processor shall notify the Controller of any intended addition or replacement of Sub-Processors at least [30] calendar days in advance.

7.4.3 The Controller may object to the addition or replacement of a Sub-Processor within [14] calendar days of receiving notification. The objection must be on reasonable grounds related to data protection.

7.4.4 If the Controller objects and the Parties cannot resolve the objection within [30] calendar days, either Party may terminate the affected services.

7.4.5 The Processor shall impose on each Sub-Processor, by way of a contract, data protection obligations equivalent to those set out in this Agreement, in accordance with Article 28(4) GDPR.

7.4.6 The Processor shall remain fully liable to the Controller for the performance of each Sub-Processor's obligations.

7.4.7 The current list of approved Sub-Processors is set out in Annex III.

### 7.5 Data Subject Rights Assistance [Article 28(3)(e)]

Taking into account the nature of the Processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subject rights under Chapter III of the GDPR, including rights of access, rectification, erasure, restriction, portability, and objection.

### 7.6 Compliance Assistance [Article 28(3)(f)]

The Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of Processing and the information available to the Processor.

### 7.7 Data Return and Deletion [Article 28(3)(g)]

7.7.1 Upon termination of this Agreement, the Processor shall, at the Controller's choice:
  (a) Return all Personal Data to the Controller in a commonly used, machine-readable format; or
  (b) Delete all Personal Data and certify such deletion in writing.

7.7.2 The Processor shall complete the chosen option within [90] calendar days of termination.

7.7.3 The Processor shall provide written certification of deletion, signed by an authorised officer.

7.7.4 If Union or Member State law requires the Processor to retain Personal Data, the Processor shall inform the Controller and shall limit Processing to that required by law.

### 7.8 Audit Rights [Article 28(3)(h)]

7.8.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement and Article 28 GDPR.

7.8.2 The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or a third-party auditor mandated by the Controller.

7.8.3 Audits shall be conducted with reasonable notice of [30] calendar days, during normal business hours, and not more frequently than [once per year], unless triggered by a specific compliance concern or Personal Data Breach.

7.8.4 The Processor may satisfy audit requirements by providing current SOC 2 Type II reports or ISO 27001 certification reports, provided the Controller may still conduct its own audit upon reasonable cause.

## 8. Personal Data Breach Notification

8.1 The Processor shall notify the Controller without undue delay, and in any event within [24] hours, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data.

8.2 The notification shall include:
  (a) A description of the nature of the breach;
  (b) Categories and approximate number of Data Subjects affected;
  (c) Categories and approximate number of records affected;
  (d) Name and contact details of the Processor's data protection officer or contact point;
  (e) Description of likely consequences;
  (f) Description of measures taken or proposed to address the breach.

8.3 The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

## 9. International Transfers

9.1 The Processor shall not transfer Personal Data to any country outside the European Economic Area without the prior written consent of the Controller and only where:
  (a) The European Commission has decided that the third country ensures an adequate level of protection (Article 45 GDPR); or
  (b) Appropriate safeguards have been provided pursuant to Article 46 GDPR, including Standard Contractual Clauses adopted by the European Commission.

9.2 Where transfers are made on the basis of Standard Contractual Clauses, the module applicable to the transfer is appended to this Agreement.

## 10. Liability

10.1 Each Party shall be liable for damages caused by Processing that infringes the GDPR in accordance with Article 82 GDPR.

10.2 The Processor shall be liable for damage caused by Processing where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Controller.

## 11. Term and Termination

11.1 This Agreement shall come into effect on the Effective Date and shall continue for the duration of the MSA.

11.2 Obligations relating to confidentiality, data return/deletion, audit rights, and indemnification shall survive termination.

## 12. Governing Law and Jurisdiction

12.1 This Agreement shall be governed by [applicable law].

12.2 Any disputes shall be submitted to the exclusive jurisdiction of [designated courts].

---

## Annex I — Description of Processing

| Element | Details |
|---------|---------|
| **Subject-matter** | [Description of services] |
| **Duration** | [Co-terminus with MSA + return/deletion period] |
| **Nature of processing** | [Operations: collection, storage, analysis, reporting, deletion] |
| **Purpose** | [Specific business purpose] |

**Personal Data Categories:**

| Category | Types | Sensitivity |
|----------|-------|-------------|
| [Category] | [Specific types] | [Standard/Elevated/High] |

**Data Subject Categories:**

| Category | Approximate Volume |
|----------|-------------------|
| [Category] | [Number] |

**Processing Locations:**

| Location | Function |
|----------|----------|
| [City, Country] | [Primary/Backup/Support] |

---

## Annex II — Technical and Organisational Measures

| Measure | Description |
|---------|-------------|
| **Encryption at rest** | [Standard and implementation] |
| **Encryption in transit** | [Protocol and minimum version] |
| **Access control** | [RBAC, MFA, least privilege] |
| **Network security** | [Segmentation, firewall, DDoS] |
| **Physical security** | [Facility controls] |
| **Incident response** | [SOC, IRP, notification] |
| **Business continuity** | [RPO, RTO, DR testing] |
| **Personnel security** | [Background checks, training] |
| **Logging and monitoring** | [SIEM, retention, alerting] |
| **Vulnerability management** | [Scanning, patching, pen testing] |

---

## Annex III — Approved Sub-Processors

| Sub-Processor | Location | Processing Description | Transfer Mechanism |
|--------------|----------|----------------------|-------------------|
| [Name] | [Country] | [Function] | [N/A / SCC / Adequacy] |

---

## Signatures

**Controller: Summit Cloud Partners**

Name: ________________________
Title: ________________________
Date: ________________________
Signature: ________________________

**Processor: [Vendor Name]**

Name: ________________________
Title: ________________________
Date: ________________________
Signature: ________________________