All Countries
Data Privacy
Controller To Controller DPA

Controller To Controller DPA Template for Indonesia

Create a bespoke document in minutes,  or upload and review your own.

4.6 / 5
4.8 / 5

Let's create your Controller To Controller DPA

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

Controller To Controller DPA

"I need a Controller to Controller DPA under Indonesian law for a data sharing arrangement between my fintech company and a partner bank, with specific provisions for processing customer financial data and cross-border transfers to Singapore, to be implemented by March 2025."

Celebrated by
Collaborations with
Investors
Document background
This Controller to Controller DPA is essential for organizations in Indonesia that share personal data while maintaining independent control over their respective data processing activities. The document is required under Indonesian Law No. 27 of 2022 on Personal Data Protection when two or more data controllers need to establish a formal framework for sharing personal data. It outlines the terms and conditions for data sharing, including security requirements, data subject rights management, breach notification procedures, and compliance obligations. The agreement is particularly crucial for businesses engaging in joint ventures, partnerships, or regular data sharing arrangements where each party acts as an independent controller. The document ensures compliance with Indonesian data protection regulations while providing clarity on roles, responsibilities, and liability allocation between the participating controllers.
Suggested Sections

1. Parties: Identification of the data controllers entering into the agreement

2. Background: Context of the data sharing relationship and purpose of the agreement

3. Definitions: Definitions of key terms used in the agreement, aligned with Indonesian PDP Law terminology

4. Scope and Purpose: Details of the personal data sharing arrangement and legitimate purposes for processing

5. Roles and Responsibilities: Specific obligations and responsibilities of each controller under Indonesian law

6. Legal Basis for Processing: Identification of legal grounds for data processing under Indonesian PDP Law

7. Data Protection Principles: Commitment to comply with Indonesian data protection principles

8. Security Measures: Technical and organizational measures required to protect personal data

9. Data Subject Rights: Procedures for handling data subject requests and ensuring rights under Indonesian law

10. Data Breach Notification: Procedures for handling and reporting personal data breaches

11. Term and Termination: Duration of the agreement and termination provisions

12. Governing Law and Jurisdiction: Confirmation of Indonesian law as governing law and jurisdiction for disputes

Optional Sections

1. Cross-border Data Transfers: Required when personal data will be transferred outside Indonesia, including compliance with transfer requirements

2. Industry-Specific Requirements: Include when processing data in regulated sectors (e.g., financial services, healthcare)

3. Joint Controller Arrangements: Required when both parties jointly determine processing purposes and means

4. Audit Rights: Optional provisions for mutual auditing of data protection compliance

5. Insurance Requirements: Optional section specifying required insurance coverage for data protection

6. Data Protection Impact Assessment: Include when processing poses high risks to data subjects

Suggested Schedules

1. Schedule 1 - Categories of Personal Data: Detailed list of personal data categories being shared

2. Schedule 2 - Processing Purposes: Comprehensive description of all processing purposes

3. Schedule 3 - Technical and Organizational Measures: Detailed security measures implemented by both parties

4. Schedule 4 - Data Subject Rights Procedure: Detailed procedures for handling data subject requests

5. Schedule 5 - Data Breach Response Plan: Detailed procedures for responding to data breaches

6. Appendix A - Contact Details: Key contacts for data protection matters at both controllers

7. Appendix B - Sub-processor List: If applicable, list of authorized sub-processors used by either controller

Authors

Alex Denne

Head of Growth (Open Source Law) @ Genie AI | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

Linkedin in social icon imageX social icon image
alex.den.21@genieai.co
Relevant legal definitions
Agreement
Applicable Data Protection Laws
Business Day
Confidential Information
Controller 1
Controller 2
Cross-border Transfer
Data Breach
Data Protection Impact Assessment
Data Protection Laws
Data Protection Officer
Data Subject
Data Subject Rights
Effective Date
Electronic System
Indonesian PDP Law
Law Enforcement Request
Personal Data
Processing
Processor
Restricted Transfer
Security Measures
Sensitive Personal Data
Services
Special Category Personal Data
Sub-processor
Supervisory Authority
Technical and Organizational Measures
Term
Third Party
Transfer Mechanism
Transferred Personal Data
Relevant Industries

Financial Services

Healthcare

E-commerce

Technology

Insurance

Telecommunications

Education

Professional Services

Real Estate

Retail

Transportation

Manufacturing

Media and Entertainment

Relevant Teams

Legal

Compliance

Information Security

Data Protection

Information Technology

Risk Management

Operations

Privacy

Data Governance

Regulatory Affairs

Relevant Roles

Chief Privacy Officer

Data Protection Officer

Legal Counsel

Compliance Manager

Information Security Manager

Risk Manager

Chief Information Security Officer

Chief Technology Officer

Privacy Manager

Operations Director

Chief Legal Officer

Data Governance Manager

IT Security Manager

Regulatory Compliance Officer

Business Development Manager

Industries
Law No. 27 of 2022 on Personal Data Protection: Indonesia's primary data protection law that establishes the framework for personal data processing, rights of data subjects, and obligations of data controllers and processors
Government Regulation No. 71 of 2019: Regulation concerning the Implementation of Electronic Systems and Transactions, which includes provisions relevant to data processing and electronic system operations
Minister of Communication and Informatics Regulation No. 20 of 2016: Regulation on Personal Data Protection in Electronic Systems, providing specific requirements for protecting personal data in electronic systems
Law No. 11 of 2008 on Electronic Information and Transactions (as amended by Law No. 19 of 2016): Provides the legal framework for electronic transactions and information, including aspects of data protection and cyber security
Indonesian Civil Code (KUHPerdata): Provides the basic framework for contract law and legal agreements in Indonesia, which is relevant for the contractual aspects of the DPA
MOCI Regulation 5 of 2020: Regulation concerning Private Electronic System Operators, which includes specific obligations for private sector entities handling electronic systems and data
Teams

Employer, Employee, Start Date, Job Title, Department, Location, Probationary Period, Notice Period, Salary, Overtime, Vacation Pay, Statutory Holidays, Benefits, Bonus, Expenses, Working Hours, Rest Breaks,  Leaves of Absence, Confidentiality, Intellectual Property, Non-Solicitation, Non-Competition, Code of Conduct, Termination,  Severance Pay, Governing Law, Entire Agreemen

Find the exact document you need

Personal Information Processing Agreement

An Indonesian law-governed agreement establishing terms for personal data processing between controller and processor, ensuring compliance with Indonesia's PDP Law.

find out more

DPA Data Processing Addendum

An Indonesian law-compliant Data Processing Addendum that governs personal data processing activities between controllers and processors under Indonesia's PDP Law.

find out more

Joint Controller Agreement

An agreement under Indonesian law governing the relationship between joint controllers who share responsibility for personal data processing.

find out more

Personal Data Agreement

An Indonesian law-compliant Personal Data Agreement establishing data processing roles and responsibilities under the 2022 PDP Law.

find out more

Data Processing Addendum

A legal agreement governing personal data processing activities under Indonesian law, ensuring compliance with the PDP Law and defining controller-processor obligations.

find out more

Third Party Processor Agreement

An Indonesian law-compliant agreement governing personal data processing activities between a data controller and third-party processor under UU PDP requirements.

find out more

Personal Data Collection Agreement

An Indonesian law-compliant agreement governing the collection and processing of personal data under the 2022 PDP Law.

find out more

Data Sharing Agreement Controller To Processor

An Indonesian law-governed agreement establishing terms for personal data processing between a controller and processor, compliant with Indonesia's PDP Law.

find out more

Controller To Controller Data Processing Agreement

An agreement governing personal data sharing between two controllers under Indonesian law, ensuring compliance with the PDP Law and related regulations.

find out more

Intra Group Data Transfer Agreement

An agreement governing intra-group data transfers in compliance with Indonesian data protection laws and regulations.

find out more

Data Controller To Data Controller Agreement

An Indonesian law-compliant agreement between two data controllers governing the sharing and processing of personal data under the PDP Law.

find out more

Controller To Controller DPA

An Indonesian law-compliant Controller to Controller DPA governing personal data sharing arrangements between independent data controllers.

find out more

DPA Agreement

An Indonesian law-compliant agreement governing personal data processing between controllers and processors, aligned with Indonesia's PDP Law requirements.

find out more

Third Party Data Processing Agreement

An Indonesian law-compliant agreement governing personal data processing arrangements between controllers and processors under the PDP Law 2022.

find out more

Personal Data Transfer Agreement

An agreement governing personal data transfers under Indonesian law, ensuring compliance with PDP Law requirements and data protection regulations.

find out more

Data Protection Agreement For Employees

An Indonesian law-compliant agreement governing the protection of employee personal data under the PDP Law and related regulations.

find out more

Sub Processing Agreement

An Indonesian law-governed agreement establishing terms for delegated data processing activities between a processor and sub-processor, ensuring compliance with Indonesian PDP Law.

find out more

International Data Transfer Agreement

An Indonesian law-compliant agreement governing the international transfer of personal data, ensuring compliance with UU PDP and related regulations.

find out more

Download our whitepaper on the future of AI in Legal

By providing your email address you are consenting to our Privacy Notice.
Thank you for downloading our whitepaper. This should arrive in your inbox shortly. In the meantime, why not jump straight to a section that interests you here: https://www.genieai.co/our-research
Oops! Something went wrong while submitting the form.

Genie’s Security Promise

Genie is the safest place to draft. Here’s how we prioritise your privacy and security.

Your documents are private:

We do not train on your data; Genie’s AI improves independently

All data stored on Genie is private to your organisation

Your documents are protected:

Your documents are protected by ultra-secure 256-bit encryption

Our bank-grade security infrastructure undergoes regular external audits

We are ISO27001 certified, so your data is secure

Organizational security

You retain IP ownership of your documents

You have full control over your data and who gets to see it

Innovation in privacy:

Genie partnered with the Computational Privacy Department at Imperial College London

Together, we ran a £1 million research project on privacy and anonymity in legal contracts

Want to know more?

Visit our Trust Centre for more details and real-time security updates.

Read our Privacy Policy.