1. Cross-border Data Transfers: Required when personal information will be transferred outside of Canada

2. Sector-Specific Requirements: Include when dealing with regulated sectors such as healthcare or financial services

3. Audit Rights: Optional provisions for mutual audit rights between controllers

4. Insurance Requirements: Specific insurance obligations for high-risk processing activities

5. Data Retention and Disposal: Specific requirements for retention periods and secure disposal methods

6. Subprocessing: Required when either controller may engage subprocessors

7. Force Majeure: Optional provisions for handling circumstances beyond parties' control

1. Schedule A - Categories of Personal Information: Detailed list of personal information types being shared

2. Schedule B - Technical and Security Requirements: Specific security measures and technical requirements for data sharing

3. Schedule C - Data Processing Activities: Detailed description of processing activities carried out by each controller

4. Schedule D - Contact Points and Escalation Procedures: Key contacts and procedures for operational and emergency situations

5. Schedule E - Privacy Impact Assessment: Summary of privacy impact assessment findings and mitigation measures

6. Appendix 1 - Standard Operating Procedures: Detailed procedures for day-to-day operations and data handling

7. Appendix 2 - Breach Response Plan: Detailed procedures for responding to and managing data breaches