1. Cross-border Data Transfers: Required when personal data will be transferred outside Australia

2. Direct Marketing: Include when joint processing involves marketing activities

3. Special Categories of Data: Required when processing sensitive information as defined in the Privacy Act

4. Data Protection Impact Assessment: Include when high-risk processing activities require prior assessment

5. Sub-processing: Include when either controller may engage sub-processors

6. Insurance Requirements: Include when specific insurance coverage is required for data protection

7. Audit Rights: Include when parties require mutual audit rights for compliance verification

1. Schedule 1 - Description of Processing Activities: Detailed description of data processing activities, categories of data, and purposes

2. Schedule 2 - Technical and Organizational Security Measures: Specific security requirements and standards to be maintained by both parties

3. Schedule 3 - Data Subject Request Procedure: Detailed procedures for handling access requests and other data subject rights

4. Schedule 4 - Data Breach Response Plan: Detailed procedures for responding to and managing data breaches

5. Schedule 5 - Contact Details and Authorized Personnel: Key contacts and authorized personnel for various aspects of the agreement

6. Appendix A - Data Flow Diagram: Visual representation of how data flows between the joint controllers

7. Appendix B - Privacy Notice Template: Template for privacy notices to be provided to data subjects