¶¶Òõ¶ÌÊÓƵ

The Controller to Controller Data Processing Agreement is essential when two organizations, each acting as independent data controllers, need to share personal data while maintaining compliance with New Zealand's privacy laws. This document becomes necessary when both parties independently determine the purposes and means of processing personal data and need to establish clear guidelines for data sharing, protection, and mutual responsibilities. The agreement is particularly relevant in scenarios involving regular data exchanges, joint projects, or integrated services where both parties maintain separate control over the data processing activities. It must comply with the New Zealand Privacy Act 2020 and includes provisions for data security, breach notification, cross-border transfers, and data subject rights. The document helps organizations maintain transparency, establish clear accountability, and ensure proper data protection measures are in place.

1. Parties: Identification of the data controllers entering into the agreement

2. Background: Context of the data sharing arrangement and relationship between the parties

3. Definitions: Definitions of key terms used in the agreement, including specific data protection terminology

4. Purpose and Scope: Detailed description of the purpose of data sharing and types of personal data involved

5. Roles and Responsibilities: Clear delineation of each controller's obligations and responsibilities

6. Legal Basis for Processing: Specification of the legal grounds for data processing by each controller

7. Data Protection Principles: Commitment to comply with NZ Privacy Principles and other applicable data protection requirements

8. Security Measures: Required technical and organizational security measures for data protection

9. Data Subject Rights: Procedures for handling data subject requests and ensuring rights are respected

10. Data Breach Notification: Process for notifying and cooperating in case of data breaches

11. Cross-border Data Transfers: Rules and safeguards for international data transfers

12. Confidentiality: Obligations regarding confidentiality of shared data

13. Term and Termination: Duration of the agreement and termination provisions

14. Liability and Indemnification: Allocation of liability and indemnification obligations

15. General Provisions: Standard contractual clauses including governing law, jurisdiction, and amendment procedures