Supplier Data Processing Agreement Template for Denmark

The Supplier Data Processing Agreement is a mandatory legal document required under Article 28 of the GDPR and Danish data protection law whenever a company (controller) engages a supplier (processor) to process personal data on its behalf. This document is essential for establishing clear responsibilities and obligations regarding data protection, security measures, and compliance requirements. It should be put in place before any data processing begins and must reflect specific Danish legal requirements while ensuring broader EU GDPR compliance. The agreement typically accompanies a main service agreement and includes detailed schedules specifying the nature of data processing activities, security measures, and approved sub-processors. It's particularly crucial in the Danish business context where data protection authorities actively enforce compliance and where businesses must demonstrate accountability in their data processing relationships.

1. Parties: Identification of the data controller and data processor, including full legal names, registration numbers, and addresses

2. Background: Context of the relationship, reference to main service agreement, and purpose of this DPA

3. Definitions: Key terms used in the agreement, including GDPR-specific terminology and agreement-specific definitions

4. Scope and Purpose: Details of the data processing activities, categories of data subjects and personal data

5. Controller's Instructions: Explicit instructions for processing, including permitted activities and restrictions

6. Processor Obligations: Core obligations including confidentiality, security measures, and assistance requirements

7. Sub-processors: Rules for engaging sub-processors, including approval process and obligations

8. Data Subject Rights: Processor's obligations to assist with data subject requests

9. Personal Data Breaches: Breach notification requirements and response procedures

10. Data Protection Impact Assessments: Obligations to assist with DPIAs and prior consultations

11. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

12. International Transfers: Rules for transferring personal data outside the EU/EEA

13. Confidentiality: Confidentiality obligations for processed data and agreement terms

14. Term and Termination: Duration of the agreement and termination provisions

15. Return or Deletion of Data: Obligations regarding personal data upon agreement termination

16. Liability and Indemnification: Allocation of liability and indemnification obligations

17. Governing Law and Jurisdiction: Specification of Danish law and jurisdiction for disputes