¶¶Òõ¶ÌÊÓƵ

The Processor to Processor DPA is essential when one data processor (First Processor) needs to delegate data processing activities to another processor (Second Processor) under Swiss law. This document becomes necessary when a processor, already engaged by a controller, needs to subcontract certain processing activities while maintaining compliance with Swiss data protection requirements, particularly the FADP/DSG. The agreement covers crucial aspects such as security measures, data breach procedures, audit rights, and liability allocation between processors. It's particularly relevant for cross-border data processing operations and ensures that appropriate safeguards are in place throughout the data processing chain. The document should be used whenever there's a need to establish a formal processing relationship between two processors, ensuring that data protection obligations flow down from the original controller through the processing chain.

1. Parties: Identification of the two processors entering into the agreement

2. Background: Context of the processing relationship and relationship to the primary controller

3. Definitions: Key terms used throughout the agreement, including specific Swiss law terminology

4. Scope and Purpose: Details of the processing activities and purposes covered by the agreement

5. Obligations of the First Processor: Responsibilities and commitments of the processor delegating the processing activities

6. Obligations of the Second Processor: Responsibilities and commitments of the processor receiving the processing activities

7. Technical and Organizational Measures: Security measures required to ensure appropriate data protection

8. Sub-processing: Conditions and requirements for engaging additional sub-processors

9. Data Subject Rights: Procedures for handling data subject requests and ensuring rights can be exercised

10. Personal Data Breach: Notification requirements and procedures in case of data breaches

11. Audit Rights: Provisions for monitoring and verifying compliance

12. Liability and Indemnification: Allocation of responsibility and liability between the parties

13. Term and Termination: Duration of the agreement and conditions for termination

14. Return or Deletion of Data: Obligations regarding personal data upon termination

15. Governing Law and Jurisdiction: Specification of Swiss law application and jurisdiction