��������Ƶ

This Data Processing Agreement is essential for organizations operating in the Philippines that engage third parties to process personal data on their behalf. The document is required under the Philippine Data Privacy Act of 2012 and must be implemented whenever a data controller outsources the processing of personal data to a data processor. The agreement covers crucial aspects such as data security measures, confidentiality obligations, sub-processing requirements, breach notification procedures, and compliance with data subject rights. It is particularly important in contexts involving cross-border data transfers, cloud services, outsourcing arrangements, and any situation where personal data is handled by external service providers. The document must align with the National Privacy Commission's guidelines and includes specific provisions for demonstrating compliance with Philippine data protection regulations.

1. Parties: Identification of the Data Controller and Data Processor, including their complete legal names, addresses, and registration details

2. Background: Context of the agreement, relationship between the parties, and purpose of the data processing activities

3. Definitions: Definitions of key terms used in the agreement, aligned with Philippine Data Privacy Act definitions

4. Scope and Purpose of Processing: Detailed description of the authorized data processing activities, types of personal data, and processing purposes

5. Obligations of the Data Processor: Core responsibilities including processing only on documented instructions, confidentiality, security measures, and assistance to the controller

6. Obligations of the Data Controller: Responsibilities including providing clear instructions, ensuring legal basis for processing, and responding to data subject requests

7. Data Security Measures: Technical and organizational security measures required under Philippine law

8. Sub-processing: Conditions and requirements for engaging sub-processors

9. Data Breach Notification: Procedures for handling and reporting data breaches as per NPC requirements

10. Data Subject Rights: Procedures for handling data subject requests and assisting the controller in responding to them

11. Audit Rights: Controller's right to audit and processor's obligation to demonstrate compliance

12. Term and Termination: Duration of the agreement and termination provisions

13. Return or Deletion of Data: Obligations regarding personal data upon termination of services

14. Governing Law and Jurisdiction: Specification of Philippine law as governing law and jurisdiction for disputes