Controller Processor Agreement Template for Australia

A Controller Processor Agreement is a critical legal document that governs the relationship between organizations that collect personal data (controllers) and third-party service providers that process that data (processors). Under Australian privacy law, this agreement is essential whenever you outsource data processing activities to external parties, ensuring both organizations understand their obligations and liabilities under the Privacy Act 1988.

When do you need this document?

You need a Controller Processor Agreement whenever your organization engages external service providers to handle personal data on your behalf. This includes cloud storage providers, software-as-a-service platforms, marketing agencies processing customer data, payroll service providers, IT support companies accessing employee information, and analytics firms processing user data. The agreement is also required when engaging sub-processors or when your service provider uses additional third parties. Australian organizations must have these agreements in place before any data processing begins to ensure compliance with the Australian Privacy Principles and avoid potential penalties for privacy breaches.

Key legal considerations

The agreement must clearly define the scope and purpose of data processing activities, specifying what personal information will be processed and for what legitimate business purposes. Security measures and data protection protocols must be detailed, including encryption requirements, access controls, and incident response procedures. The document should establish clear data retention and deletion schedules, outline procedures for handling data subject access requests, and specify notification requirements in case of data breaches. Liability allocation between controller and processor is crucial, particularly regarding compensation for privacy breaches and regulatory penalties. The agreement must also address cross-border data transfers if the processor stores or processes data outside Australia.

Legal requirements in Australia

Under the Privacy Act 1988 and Australian Privacy Principles, organizations must ensure that any third party processing personal data provides adequate protection equivalent to what the controller would provide. The agreement must comply with APP 8, which requires organizations to take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs. Data breach notification requirements under the Notifiable Data Breaches scheme must be clearly addressed, including timeframes for notification and responsibilities for reporting to the Office of the Australian Information Commissioner. The agreement should reference relevant state privacy laws where applicable and ensure the processor maintains appropriate records of processing activities as required under Australian privacy legislation.