Controller Processor Agreement Template for Belgium

The Controller Processor Agreement is a mandatory requirement under Article 28 of the GDPR and the Belgian Data Protection Act when an organization (controller) engages another party (processor) to process personal data on its behalf. This document is essential for ensuring compliance with data protection laws in Belgium and the broader EU, establishing clear responsibilities and obligations for both parties. It must be in place before any data processing begins and should detail the nature, scope, and purpose of processing, security measures, confidentiality requirements, and procedures for data breach notification. The agreement must reflect both Belgian-specific legal requirements and broader EU data protection principles, making it particularly relevant for organizations operating in or providing services to Belgian entities. It forms a crucial part of an organization's data protection compliance framework and should be regularly reviewed to ensure ongoing alignment with evolving data protection requirements and guidance from the Belgian Data Protection Authority.

1. Parties: Identification of the Data Controller and Data Processor, including registered addresses and authorized representatives

2. Background: Context of the agreement, relationship between parties, and purpose of data processing activities

3. Definitions: Key terms used in the agreement, incorporating GDPR definitions and any additional specific terms

4. Scope and Purpose of Processing: Detailed description of authorized processing activities, categories of data, and processing purposes

5. Duration: Term of the agreement, including commencement date and termination provisions

6. Nature and Purpose of Processing: Specific details about how and why the data will be processed

7. Processor Obligations: Core obligations under GDPR Article 28, including processing only on documented instructions

8. Security Measures: Technical and organizational measures to ensure appropriate security of processing

9. Sub-processing: Conditions and requirements for engaging sub-processors

10. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests

11. Data Breach Notification: Procedures and timelines for notifying the controller of any personal data breaches

12. Audit Rights: Controller's rights to audit and inspect processor's compliance

13. Cross-border Transfers: Rules and safeguards for transfers of personal data outside the EEA

14. Confidentiality: Confidentiality obligations regarding processed personal data

15. Termination and Data Deletion: Procedures for agreement termination and subsequent data handling

16. Governing Law and Jurisdiction: Specification of Belgian law as governing law and jurisdiction for disputes