tiktok³ÉÈË°æ

The DPA Contract is a crucial legal document required whenever an organization (data controller) engages another party (data processor) to process personal data on its behalf in India. This agreement has become increasingly important with the implementation of stronger data protection regulations in India, including the Digital Personal Data Protection Act, 2023. The document outlines specific obligations for data processors, including implementing appropriate security measures, maintaining confidentiality, and ensuring compliance with Indian data protection laws. It covers essential aspects such as data breach notification requirements, sub-processor engagement, cross-border data transfers, and audit rights. The agreement is particularly relevant for organizations operating in India or processing data of Indian residents, and it helps ensure regulatory compliance while establishing clear accountability and responsibilities between the parties involved.

1. Parties: Identification of the data controller and data processor, including their registered addresses and company details

2. Background: Context of the agreement, relationship between parties, and purpose of data processing activities

3. Definitions: Definitions of key terms used in the agreement, including technical terms and those defined by applicable Indian laws

4. Scope and Purpose of Processing: Detailed description of the permitted data processing activities, types of personal data, and processing purposes

5. Duration of Processing: Term of the agreement and duration of data processing activities

6. Obligations of the Data Processor: Core responsibilities of the processor including security measures, confidentiality, and compliance requirements

7. Obligations of the Data Controller: Responsibilities of the controller including providing instructions and ensuring lawful basis for processing

8. Security Measures: Technical and organizational security measures required to protect personal data

9. Data Breach Notification: Procedures and timeframes for reporting data breaches

10. Sub-processing: Conditions and requirements for engaging sub-processors

11. Data Subject Rights: Procedures for handling data subject requests and supporting the controller

12. Audit Rights: Controller's right to audit and processor's obligation to demonstrate compliance

13. Liability and Indemnification: Allocation of liability and indemnification obligations

14. Termination: Conditions for termination and data handling upon termination

15. Governing Law and Jurisdiction: Specification of Indian law as governing law and jurisdiction for disputes