Joint controllers data sharing agreement (unilateral)

Joint controllers data sharing agreement (unilateral) contents

1. Definitions: definitions; data protection terms.
2. Term: commencement of term; end of term.
3. Obligations to share Personal Data: obligation on 
   Supplier
    to share personal data.
4. Data quality:
   Supplier
   to ensure data quality.
5. No special categories: no special categories of personal data to be shared by 
   Supplier
   ; no criminal conviction data to be shared by 
   Supplier
   .
6. Parties acting as joint controllers: parties are joint controllers of
   Supplier
   personal data; purposes of processing
   Supplier
   personal data (joint controllers); legal bases of sharing first party personal data (joint controllers); joint controllership does not apply to all processing of data disclosed by 
   Supplier
   .
7. Compliance with Data Protection Laws: compliance with data protection laws with respect to relevant processing;
   Supplier
   personal data collected in accordance with law; requirements relating to consent-based processing of personal data; responsibility for data protection transparency for relevant processing; data protection law compliance assistance for relevant processing.
8. Further disclosure of
   Supplier
   Personal Data:
   Recipient
   must not disclose personal data; obligations on disclosure of
   Supplier
   personal data; section does not prevent disclosure of anonymised data; section does not prevent disclosure of personal data to processors for relevant processing.
9. International transfers of 
   Supplier
   Personal Data: prohibition on third country transfers of
   Supplier
   personal data; exceptions to prohibition on third country transfers of
   Supplier
   personal data; approved international transfer clauses take precedence over 
   Agreement
   .
10. Relevant Processing by joint controllers and supervisory authorities: communications from supervisory authorities about relevant processing; cooperation in relation to supervisory authority action concerning relevant processing.
11. Relevant Processing and data subject rights: communications from data subjects about relevant processing; cooperation in relation to relevant processing and data subject rights; primary data subject contact for joint controllers.
12. Security of Relevant Processing: appropriate measures to secure relevant processing; particular security measures for relevant processing.
13. Data breaches involving
    the Supplier
    Personal Data: notification of data breaches involving
    Supplier
    personal data; assistance in relation to
    Supplier
    personal data breaches.
14. Retention and deletion: retention periods for
    Supplier
    personal data; section subject to effects of termination.
15. Compliance audit: right to audit compliance; notice of audit; cooperation in relation to audit; costs of licence audit; limits on audit right.
16. Changes to Data Protection Laws: changes to data protection law.
17. Recipient
     confidentiality obligations:
    Recipient
    confidentiality undertaking; disclosure of confidential information by
    Recipient
    to certain persons; exceptions to
    Recipient
     confidentiality obligations; disclosures of
    Supplier
    confidential information mandated by law etc;
    Recipient
    to stop using confidential information upon termination;
    Recipient
    confidentiality obligations after termination.
18. Warranties: first party warranty of authority; second party warranty of authority; exclusion of implied warranties and representations.
19. Indemnities:
    Supplier
    indemnifies
    Recipient
    upon data protection breach;
    Recipient
    indemnifies
    Supplier
     upon data protection breach.
20. Limitations and exclusions of liability: caveats to limits of liability; interpretation of limits of liability; no liability for force majeure; per event liability cap.
21. Termination: termination by either party without cause; termination by either party upon breach; termination upon insolvency.
22. Effects of termination:
    Recipient
    to delete
    Supplier
    personal data; surviving provisions upon termination; termination does not affect accrued rights.
23. Notices: contractual notices must be in writing; methods of sending contractual notices; contact details for contractual notices; substitute contact details for notices; acknowledgement of notice by email; deemed receipt of contractual notices.
24. Data protection contacts:
    Supplier
     data protection contact;
    Recipient
    data protection contact.
25. General: no waiver; severability; variation written and signed; no assignment without written consent; no third party rights; entire agreement; governing law; exclusive jurisdiction.
26. Interpretation: statutory references; section headings not affecting interpretation; no ejusdem generis.

SCHEDULE 1 (DATA PROTECTION INFORMATION NOTICE)

Prompt for 
Recipient
data protection information notice.

SCHEDULE 2 (FORM OF CONSENT)

Prompt for 
Recipient
 form of consent.

SCHEDULE 3 (INTERNATIONAL TRANSFER CLAUSES)

Prompt for international transfer clauses.

SCHEDULE 4 (SECURITY MEASURES)

1. Supplier
   security measures: prompt for details of
   Supplier
   security measures.
2.  
   Recipient
    security measures: prompt for details of
   Recipient
   security measures.