¶¶Òõ¶ÌÊÓƵ

The Third Party Processor Agreement is essential for organizations in Malaysia that outsource the processing of personal data to external service providers. This document is required to comply with the Personal Data Protection Act 2010 (PDPA) and establishes the legal framework for data processing activities. It is particularly important when businesses engage cloud service providers, IT contractors, payroll processors, or any other third parties who will handle personal data on their behalf. The agreement defines security requirements, confidentiality obligations, data handling procedures, and compliance responsibilities while ensuring that both parties understand their obligations under Malaysian data protection laws. It should be used whenever a business (data controller) engages an external party (data processor) to perform any operations on personal data, including collection, storage, analysis, or deletion.

1. Parties: Identification of the data controller and the data processor, including full legal names and registration details

2. Background: Context of the agreement, relationship between parties, and general purpose of the data processing arrangement

3. Definitions: Definitions of key terms used in the agreement, including those from PDPA 2010

4. Scope and Purpose of Processing: Detailed description of the processing activities, types of personal data, and processing purposes

5. Obligations of the Data Processor: Core responsibilities of the processor including confidentiality, security measures, and compliance with instructions

6. Obligations of the Data Controller: Responsibilities of the controller including providing clear instructions and ensuring lawful basis for processing

7. Security Measures: Technical and organizational security measures required to protect personal data

8. Sub-processing: Conditions and requirements for engaging sub-processors

9. Data Subject Rights: Procedures for handling data subject requests and assisting the controller

10. Data Breach Notification: Procedures and timeframes for reporting and handling data breaches

11. Audit Rights: Controller's rights to audit and verify compliance

12. Liability and Indemnification: Allocation of liability and indemnification obligations

13. Term and Termination: Duration of the agreement and termination provisions

14. Return or Deletion of Data: Obligations regarding data handling upon termination

15. Governing Law and Jurisdiction: Specification of Malaysian law and jurisdiction