Personal Data Processing Agreement Template for Belgium

The Personal Data Processing Agreement is a mandatory legal document required under Article 28 of the GDPR and Belgian data protection law whenever a company (controller) engages another party (processor) to process personal data on its behalf. This agreement must be in place before any processing begins and forms part of the broader service relationship between the parties. It includes specific provisions required by Belgian law and GDPR, such as technical and organizational measures, data breach procedures, and audit rights. The agreement is particularly important in the Belgian context as it must comply with both EU-wide GDPR requirements and specific Belgian data protection regulations, including the Belgian Data Protection Act of 2018. It should be customized based on the nature of processing, types of data involved, and specific security requirements of the engagement.

1. Parties: Identification of the data controller and data processor, including registered addresses and company details

2. Background: Context of the processing relationship and purpose of the agreement

3. Definitions: Key terms used in the agreement, including GDPR-specific terminology

4. Scope and Purpose of Processing: Detailed description of the processing activities, categories of data, and processing purposes

5. Duration of Processing: Timeframe for the processing activities and agreement term

6. Obligations of the Data Controller: Responsibilities and warranties of the data controller, including lawful basis for processing

7. Obligations of the Data Processor: Core processor obligations under Article 28 GDPR, including processing only on documented instructions

8. Confidentiality: Confidentiality obligations for processed data and processing operations

9. Security of Processing: Security measures and standards required for data protection

10. Sub-processing: Conditions and requirements for engaging sub-processors

11. Data Subject Rights: Procedures for assisting controller with data subject requests

12. Personal Data Breach: Breach notification procedures and timelines

13. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

14. Liability and Indemnification: Allocation of liability and indemnification provisions

15. Termination: Termination conditions and data deletion/return obligations

16. Governing Law and Jurisdiction: Specification of Belgian law as governing law and jurisdiction for disputes