Data Protection Addendum Template for Belgium

The Data Protection Addendum (DPA) is a crucial legal document required whenever an organization (data controller) engages another party (data processor) to process personal data on its behalf under Belgian jurisdiction. This document supplements the main service agreement and ensures compliance with both the EU General Data Protection Regulation (GDPR) and Belgian data protection laws. It becomes necessary when engaging vendors, service providers, or contractors who will handle personal data, and is particularly important for Belgian companies or those processing data of Belgian residents. The DPA details specific responsibilities, security requirements, data handling procedures, and compliance obligations, including mandatory provisions required by Article 28 of the GDPR and additional requirements under Belgian law.

1. Parties: Identification of the data controller and data processor, including registered addresses and company details

2. Background: Context of the DPA, reference to the main agreement, and purpose of the addendum

3. Definitions: Key terms used in the DPA, including GDPR-specific terminology and agreement-specific definitions

4. Scope and Purpose of Processing: Detailed description of the personal data processing activities, categories of data subjects, and types of personal data

5. Obligations of the Processor: Core processor obligations under GDPR Article 28, including processing only on documented instructions

6. Technical and Organizational Measures: Security measures implemented to protect personal data, including specific Belgian security requirements

7. Sub-processing: Conditions and requirements for engaging sub-processors, including authorization process

8. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests

9. Personal Data Breach: Breach notification procedures, timing, and responsibilities

10. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

11. Data Return and Deletion: Obligations regarding data return or deletion upon agreement termination

12. Liability and Indemnification: Allocation of liability between parties and indemnification provisions

13. Term and Termination: Duration of the DPA and termination provisions

14. Governing Law and Jurisdiction: Confirmation of Belgian law application and jurisdiction