Data Controller To Data Controller Agreement

Data Controller To Data Controller Agreement Template for United States

Create a bespoke document in minutes, or upload and review your own.

4.6 / 5

4.8 / 5

Let's create your Data Controller To Data Controller Agreement

1. Select your governing law and document type:

2. Enter your key requirements:

3. Create your document to edit, review or download

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

"I need a Data Controller to Data Controller Agreement for sharing healthcare patient data between our hospital network and a research institution, ensuring HIPAA compliance and including specific security requirements for sensitive medical information, with the agreement to commence from March 2025."

Document background

The Data Controller to Data Controller Agreement is essential when two organizations need to share personal data while maintaining independent control over the processing of that data. This agreement type is particularly relevant under U.S. privacy law frameworks, where organizations must establish clear responsibilities and compliance mechanisms for data sharing. The agreement covers crucial aspects such as security measures, breach notification procedures, and compliance with both federal regulations and state privacy laws like CCPA/CPRA. It's particularly important when sharing regulated data types or operating in jurisdictions with specific privacy requirements.

Suggested Sections

1. Parties: Identification of the data controllers, including registered addresses and company details

2. Background: Context of the data sharing arrangement and relationship between the parties

3. Definitions: Key terms used throughout the agreement, including specific data types and processing activities

4. Purpose and Scope: Detailed description of why data is being shared and what data is covered

5. Data Protection Obligations: Core obligations of each controller regarding data protection and security

6. Security Measures: Specific security requirements and standards to be maintained

7. Data Breach Notification: Procedures for handling and reporting data breaches

8. Term and Termination: Duration of agreement and termination provisions

Optional Sections

1. Cross-Border Transfers: Provisions for international data transfers when data will be transferred outside the US

2. Industry-Specific Compliance: Additional requirements for specific regulated sectors when handling HIPAA, GLBA, or other regulated data

3. Data Subject Rights Management: Procedures for handling data subject requests when processing data subject to CCPA/CPRA or similar laws

4. Joint Controller Arrangements: Specific provisions for joint control scenarios when parties jointly determine processing purposes

Suggested Schedules

1. Data Categories Schedule: Detailed list of data categories being shared

2. Security Requirements Schedule: Technical and organizational security measures

3. Processing Activities Schedule: Detailed description of processing activities

4. Sub-processor Schedule: List of approved sub-processors if applicable

5. Data Transfer Mechanisms: Details of transfer mechanisms for international transfers

Authors

Alex Denne

Head of Growth (Open Source Law) @ ��Ƶ | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

alex.den.21@genieai.co

Relevant legal definitions

Agreement

Confidential Information

Effective Date

Personal Data
Personal Information

Term

Clauses

Relevant Industries

Healthcare
Financial Services
Technology
Education
Retail

Relevant Teams

Legal
Information Security
Privacy
Compliance
IT
Risk Management

Relevant Roles

Chief Privacy Officer
Data Protection Officer
Chief Information Security Officer
Privacy Counsel
Compliance Manager

Industries

FTC Act: Federal Trade Commission Act, particularly Section 5, governing unfair or deceptive practices and establishing FTC's privacy and data security enforcement authority

HIPAA: Health Insurance Portability and Accountability Act - Federal law governing protection of healthcare data and medical information

GLBA: Gramm-Leach-Bliley Act - Federal law governing collection, disclosure, and protection of consumers' personal financial information

FCRA: Fair Credit Reporting Act - Federal law regulating the collection and use of consumer credit information

FERPA: Family Educational Rights and Privacy Act - Federal law protecting the privacy of student education records

COPPA: Children's Online Privacy Protection Act - Federal law imposing requirements on operators of websites or online services directed to children under 13

CCPA/CPRA: California Consumer Privacy Act and California Privacy Rights Act - Comprehensive state privacy laws providing California residents with data privacy rights

CalOPPA: California Online Privacy Protection Act - State law requiring commercial websites to post privacy policies and comply with stated practices

VCDPA: Virginia Consumer Data Protection Act - Comprehensive state privacy law providing Virginia residents with data privacy rights

CPA: Colorado Privacy Act - State law establishing privacy rights for Colorado residents and obligations for data controllers

UCPA: Utah Consumer Privacy Act - State privacy law providing Utah residents with data privacy rights and establishing business obligations

CTDPA: Connecticut Data Privacy Act - State law establishing privacy rights for Connecticut residents and requirements for businesses processing their data

EU-US DPF: EU-US Data Privacy Framework - Framework governing transatlantic data flows between the EU and US

PIPEDA: Personal Information Protection and Electronic Documents Act - Canadian federal privacy law governing private-sector organizations' collection, use, and disclosure of personal information

Find the exact document you need

Subprocessor Agreement

A U.S.-compliant legal agreement governing the relationship between a data processor and subprocessor for personal data processing activities.

��������Ƶ

How a Sales & Marketing Lead uses ��������Ƶ to reduce contract drafting time by 95%

Let's create your Data Controller To Data Controller Agreement

Authors

Alex Denne

Find the exact document you need

Subprocessor Agreement

Controller Processor Contract

Dpa Contract

Dpa Addendum

Data Controller Dpa

Joint Data Controller Agreement

Data Processing Addendum Dpa

Third Party Processor Agreement

Personal Data Collection Agreement

International Data Protection Agreement

Data Sharing Agreement Controller To Processor

Processor To Processor Dpa

Master Data Protection Agreement

Controller To Controller Data Processing Agreement

Intra Group Data Transfer Agreement

Data Management Agreement

Data Controller To Data Controller Agreement

Commissioned Data Processing Agreement

Intercompany Data Processing Agreement

Controller To Controller Dpa

Intercompany Data Sharing Agreement

Dpa Agreement

Data Transfer Addendum

Supplier Data Processing Agreement

Personal Data Transfer Agreement

Controller Processor Agreement

Order Processing Agreement

Data Protection Agreement For Employees

Affiliate Addendum

Data Privacy Addendum

Sub Processing Agreement

International Data Transfer Agreement

Data Protection Addendum

Download our whitepaper on the future of AI in Legal

�ұ�Ծ���’s Security Promise

Your documents are private:

Your documents are protected:

Organizational security

Innovation in privacy:

Want to know more?

Draft quality legal agreements or review documents in 3 minutes

Templates

Industries

Legal Services

Manufacturing

Construction

Solutions

Use Cases

Company Types

Comparisons

Business Categories

Teams

Information

��Ƶ

How a Sales & Marketing Lead uses ��Ƶ to reduce contract drafting time by 95%

�ұ�Ծ��’s Security Promise