Data Processing Agreement Addendum Template for Belgium

The Data Processing Agreement Addendum is essential when one organization (the processor) processes personal data on behalf of another organization (the controller) under Belgian jurisdiction. This document is required for GDPR compliance and must be implemented whenever there is processing of personal data by third parties. It supplements existing service agreements by adding specific data protection provisions, ensuring compliance with both EU GDPR and Belgian data protection laws. The addendum details critical aspects such as processing purposes, security requirements, breach notification procedures, and data transfer mechanisms. It becomes particularly important when organizations engage external service providers, cloud services, or any third-party vendors who will have access to or process personal data. The document must align with Belgian legal requirements while maintaining GDPR standards for data protection.

1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses

2. Background: Context of the addendum, reference to the main agreement, and purpose of the data processing relationship

3. Definitions: Key terms used in the agreement, including those from GDPR and any additional specific terms

4. Scope and Purpose of Processing: Detailed description of the authorized processing activities and their purposes

5. Duration: Term of the processing activities and relationship to the main agreement's duration

6. Nature and Purpose of Processing: Specific details about how and why the personal data will be processed

7. Processor Obligations: Core obligations of the processor including processing only on documented instructions, confidentiality, security measures, and sub-processor requirements

8. Controller Obligations: Responsibilities and obligations of the controller, including providing documented instructions and ensuring lawful basis for processing

9. Sub-processors: Conditions and requirements for engaging sub-processors, including authorization process

10. International Transfers: Rules and requirements for transferring personal data outside the EEA

11. Security Measures: Overview of technical and organizational security measures required

12. Data Breach Notification: Procedures and timeframes for notifying the controller of any personal data breaches

13. Audit Rights: Controller's rights to audit the processor and processor's obligations to contribute to audits

14. Return or Deletion of Data: Obligations regarding personal data at the end of processing activities

15. Liability and Indemnification: Allocation of responsibility and liability between parties

16. Governing Law and Jurisdiction: Confirmation of Belgian law as governing law and jurisdiction for disputes