Intercompany Data Processing Agreement Template for Australia

An Intercompany Data Processing Agreement is a specialised contract that governs how personal data is handled between related companies within the same corporate group. Under Australian law, this agreement ensures your group entities comply with the Privacy Act 1988 and Australian Privacy Principles when sharing or processing personal information across different companies in your corporate structure.

When do you need this document?

You need this agreement when your parent company collects customer data but your subsidiary processes it for marketing campaigns, or when your holding company manages employee records that operating companies need to access for payroll and HR functions. It's essential when your Australian head office shares client information with regional subsidiaries for service delivery, or when group companies collaborate on joint projects requiring personal data exchange. The agreement becomes critical during corporate restructures where data processing responsibilities shift between entities, and when implementing shared IT systems across multiple group companies. You also need this document if your group operates across state boundaries, as different Australian jurisdictions may have varying privacy requirements.

Key legal considerations

Your agreement must clearly define which entity acts as the data controller and which serves as the data processor under Australian privacy law. The data controller retains primary responsibility for compliance with Australian Privacy Principles, while the processor must follow specific instructions and maintain appropriate security measures. You need robust data security clauses that meet Australian standards, including encryption requirements, access controls, and staff training obligations. The agreement should include comprehensive breach notification procedures that comply with the Notifiable Data Breaches scheme under the Privacy Act. Data retention and deletion clauses must align with Australian legal requirements and your privacy policy commitments. Cross-border data transfer provisions are crucial if any group entity is located outside Australia, requiring adequate protection measures or relevant exceptions under Australian privacy law.

Legal requirements in Australia

Under the Privacy Act 1988, your agreement must ensure both entities understand their obligations regarding the Australian Privacy Principles, particularly around collection, use, disclosure, and security of personal information. The agreement needs to address the Notifiable Data Breaches scheme requirements, including 30-day notification timeframes to the Office of the Australian Information Commissioner and affected individuals. State-specific privacy laws may apply depending on your entities' locations, such as the Privacy and Personal Information Protection Act 1998 in New South Wales. The Corporations Act 2001 imposes additional requirements for related party transactions, requiring proper corporate authorisation and potential disclosure obligations. Your agreement should comply with the Electronic Transactions Act 1999 if using digital signatures or electronic document execution. The Spam Act 2003 may be relevant if your data processing includes electronic marketing activities between group entities.