1. Parties: Identification of the data controller and data processor, including their registered details and primary contacts
2. Background: Context of the agreement, relationship between the parties, and purpose of the data processing activities
3. Definitions: Definitions of key terms aligned with the Privacy Act 1988 and APPs, including 'personal information', 'sensitive information', 'processing', etc.
4. Scope and Purpose of Processing: Detailed description of the authorized processing activities, types of personal information, and processing purposes
5. Obligations of the Data Controller: Responsibilities of the data controller including providing lawful instructions, obtaining consents, and ensuring legal basis for processing
6. Obligations of the Data Processor: Core responsibilities including processing only on documented instructions, maintaining confidentiality, implementing security measures, and breach notification procedures
7. Data Security: Required security measures, standards, and protocols for protecting personal information
8. Sub-processing: Conditions and requirements for engaging sub-processors, including approval processes
9. Data Breach Notification: Procedures and timeframes for reporting data breaches in accordance with the Notifiable Data Breaches scheme
10. Cross-border Data Transfers: Rules and safeguards for transferring personal information outside Australia
11. Audit Rights: Controller's rights to audit processor's compliance and processor's obligations to demonstrate compliance
12. Term and Termination: Duration of the agreement and circumstances for termination
13. Return or Destruction of Data: Obligations regarding personal information upon termination of services
14. General Provisions: Standard contractual provisions including governing law, jurisdiction, and dispute resolution
