1. Parties: Identification of the data controller (organization) and data processor (supplier), including full legal names and registered addresses
2. Background: Context of the agreement, relationship between parties, and general purpose of the data processing activities
3. Definitions: Detailed definitions of key terms used throughout the agreement, including 'Personal Information', 'Processing', 'Data Breach', and other relevant terms
4. Scope and Purpose of Processing: Detailed description of the authorized data processing activities, types of personal information involved, and permitted purposes
5. Obligations of the Processor: Core responsibilities of the supplier including processing only on documented instructions, maintaining confidentiality, and implementing security measures
6. Security Requirements: Specific technical and organizational measures required to ensure appropriate security of personal information
7. Sub-processing: Conditions and requirements for engaging sub-processors, including approval processes and flow-down obligations
8. Data Breach Notification: Procedures and timeframes for reporting data breaches, including obligations under the Notifiable Data Breaches scheme
9. Audit Rights: Controller's rights to audit the processor's compliance and processor's obligations to provide information and assistance
10. Data Subject Rights: Processor's obligations to assist the controller in responding to data subject requests and ensuring data subject rights
11. Term and Termination: Duration of the agreement, termination circumstances, and data handling obligations upon termination
12. Return or Destruction of Data: Requirements for handling personal information after contract termination or upon controller's request
13. Liability and Indemnities: Allocation of liability between parties and indemnification obligations
14. General Provisions: Standard contractual provisions including governing law, jurisdiction, and entire agreement
