Sub Processing Agreement Template

The processor shall take appropriate measures to ensure that personal data are accessible and manageable only by duly authorised personnel, that direct access to database queries is limited and that access rights to the application are defined and enforced in order to ensure that persons authorised to use a data processing system have access only to the personal data to which they have access; and that personal data may not be read, copied, modified or deleted without authorisation during processing. The processor shall take appropriate measures to implement an access policy according to which access to its system environment, personal data and other data is carried out only by authorised personnel. 14 If we set up an external data controller for the processing of personal data, a written sub-processing agreement is signed between us and the processor. This is the case, for example, when we use external document archives or when we use cloud systems in the processing of personal data, including communication with the customer. In the same way, a written agreement is always concluded between us and our customer when we act as data processors. Sub-processing agreements are also available electronically. Make sure that both parties (you and the subcontractor) validly sign the agreement in order to make it enforceable. 3. The processing includes the following types of personal data concerning data subjects: the processor must “ensure that the persons authorised to process the personal data have undertaken to respect confidentiality”.

Note that this is not the same as a confidentiality agreement. It is primarily intended to protect the interests of the data subjects, and not of the processor or data controller. 1. The purpose of the processing of personal data by the processor on behalf of the controller is as follows: the processor may process personal data “only on the documented instruction of the controller”. This is the reason for the data processing agreement itself, but must also be explicitly included in the agreement. 3.4.2 Wolters Kluwer will inform the customer if Wolters Kluwer intends to replace or use a new subcontractor. Wolters Kluwer will then indicate the name of the processor and the information relating to the place of processing as well as, upon written request of the customer, information on the transformation activity that the subcontractor is to carry out on behalf of Wolters Kluwer. The customer has the right to object in writing to such changes within 30 days of notification by Wolters Kluwer. If Wolters Kluwer still intends to replace or use a new subcontractor despite the customer`s objection, the customer has the right to terminate the contract for the relevant service within 30 days of the announcement of the change by Wolters Kluwer. Termination must be in writing, the notice is at least 30 days, but not more than 60 days.

Wolters Kluwer will then reimburse the customer for the fees paid for the period following the expiry of the notice period. . . .

Comments are closed.