tiktok³ÉÈË°æ

This Intercompany Data Processing Agreement is designed for use between affiliated companies within the same corporate group where one entity processes personal data on behalf of another under Dutch jurisdiction. The agreement is essential when group companies share or process personal data, ensuring compliance with the GDPR, Dutch GDPR Implementation Act (UAVG), and other relevant Dutch laws. It establishes clear responsibilities, processing boundaries, and compliance obligations while considering the special relationship between group entities. The document includes comprehensive provisions for data protection, security measures, breach notification, and liability allocation, along with specific schedules detailing processing activities and technical measures. This agreement is particularly important for multinational groups with Dutch operations and those seeking to maintain consistent data protection standards across their corporate structure.

1. Parties: Identification of the group companies involved - data controller entity and data processor entity

2. Background: Context of the agreement, relationship between the group companies, and purpose of the data processing arrangement

3. Definitions: Definitions of key terms, including GDPR-specific terminology and company-specific terms

4. Scope and Purpose of Processing: Detailed description of the processing activities, categories of data, and processing purposes

5. Duration and Termination: Term of the agreement, termination conditions, and data handling upon termination

6. Obligations of the Data Controller: Responsibilities and obligations of the controlling entity, including instructions and compliance oversight

7. Obligations of the Data Processor: Core processor obligations under GDPR Article 28, including processing only on documented instructions

8. Security Measures: Technical and organizational measures for data protection and security

9. Sub-processing: Conditions and requirements for engaging other group companies or external sub-processors

10. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

11. Data Breach Notification: Procedures and timelines for reporting data breaches within the group

12. Audit Rights: Controller's audit rights and processor's cooperation obligations

13. Liability and Indemnification: Allocation of liability between group companies and indemnification provisions

14. Governing Law and Jurisdiction: Specification of Dutch law as governing law and jurisdiction for disputes