/Docs/G/OneNDA-DPA/Form/0.md
  Source views: Source JSON(ish) on GitHub (VSCode)   Doc views: Document (&k=r00t): Visual Print Technical: OpenParameters Xray

---

OneDPA
PARTIES AND EXECUTION

1. First Party
   
   • Entity details:
     {P1.EntityDetails.Cl}
   • Signature:
     _________________________
   • Name:
     {P1.Signer.Name.Full}
   • Date:
     {P1.SignDate.YMD}
2. Second Party
   
   • Entity details:
     {P2.EntityDetails.Cl}
   • Signature:
     __________________________
   • Name:
     {P2.Signer.Name.Full}
   • Date:
     {P2.SignDate.YMD}

VARIABLES

1. Parties’ relationship
   Relationship: Select one (copy)- "Variables.1.sec={Variables.1.AltX.sec}" where X is 1-3:
   1. Controller to Processor
   2. Processor to Sub-Processor
   3. Independent Controller to Controller
2. Parties’ roles
   
   1. {P1.Name.Full} will act as the [Controller/Processor] [and Business] (as defined in Section 1 of the Terms)
   2. {P2.Name.Full} will act as the [Processor [and Service Provider]/Sub-Processor/Controller] (as defined in Section 1 of the Terms)
3. Contacts
   
   1. [Controller/Processor]
      • Name: {P1.Name.Full}
      • Email: {P1.Email}
      • [INSERT ADDITIONAL DETAILS]
   2. [Processor/Sub-Processor/Controller]
      • Name: {P1.Name.Full}
      • Email: {P1.Email}
      • [INSERT ADDITIONAL DETAILS]
4. Main Agreement
   {MainAgreement.Identification.cl}
5. Term
   This DPA will commence on the final date of signature and will continue for {DPA.Life.Duration}
6. Breach Notification Period
   [Without undue delay] [24 hours] [48 hours] [72 hours] after becoming aware of a personal data breach
7. Sub-processor Notification Period
   [A reasonable timeframe] [14 days] [30 days] before the new sub-processor is granted access to Personal Data
8. Liability Cap
   Each party’s aggregate liability under this DPA will not exceed [INSERT] / [the liability caps as per the Main Agreement]
9. Governing Law and Jurisdiction
   [INSERT] [As per the Main Agreement]
10. Data Protection Laws
    All laws, regulations and court orders which apply to the processing of Personal Data in:
    • the European Economic Area (EEA)
    • the United Kingdom (UK)
    • the United States (US)
    • Australia
    • [INSERT]
    This includes the [European Union Regulation (EU) 2016/679,] [the Data Protection Act 2018], [California Consumer Privacy Act of 2018 (CCPA)/California Privacy Rights Act of 2020 (CPRA)], [the Privacy Act 1998] and [INSERT], [each] as amended from time to time.
11. Services related to processing
    [INSERT] [As described in the Main Agreement]
12. Duration of processing
    [For the Term of this DPA] [INSERT]
13. Nature and purpose of processing
    [INSERT]
14. Personal Data
    The types of personal data processed are [INSERT]
15. Data subjects
    The individuals whose Personal Data will be processed are [INSERT]
16. Special provisions
    [INSERT]
17. Transfer Mechanism
    Transfer Mechanism: (copy)- "Variable.17.sec={Variable.17.AltX.sec}" where X is 1-5:
    1. N/A
    2. Standard Contractual Clauses approved by the European Commission Decision of 4 June 2021 (as amended from time to time), for the transfer of personal data from the EEA or adequate country to a third country
    3. International Data Transfer Agreement issued by the Information Commissioner’s Office under Section 119A of the Data Protection Act 2018, effective from 21 March 2022
    4. International Data Transfer Addendum issued by the Information Commissioner’s Office under Section 119A of the Data Protection Act 2018, effective from 21 March 2022
    5. The Binding Corporate Rules of [INSERT DETAILS]

Annexes
Annex 1
Security measures
Technical and organisational measures to ensure the security of Personal Data

• [Insert Processor’s/Sub-Processor’s security measures, either in full or as a link to relevant webpage]

Annex 2
Sub-processors
Current sub-processors

• [Insert Processor’s/Sub-Processor’s list of sub-processors, either in full or as a link to relevant webpage]

{Terms.Sec}