All Countries
Data Privacy
Data Controller To Data Controller Agreement

Data Controller To Data Controller Agreement Template for Indonesia

Create a bespoke document in minutes,  or upload and review your own.

4.6 / 5
4.8 / 5

Let's create your Data Controller To Data Controller Agreement

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

Data Controller To Data Controller Agreement

"I need a Data Controller to Data Controller Agreement for my fintech company to share customer payment data with a partner bank in Indonesia, ensuring compliance with the PDP Law and Bank Indonesia regulations, with implementation planned for March 2025."

Celebrated by
Collaborations with
Investors
Document background
A Data Controller to Data Controller Agreement is essential when two independent organizations need to share personal data while maintaining compliance with Indonesian data protection laws. This agreement is specifically designed for situations where both parties act as data controllers under Law No. 27 of 2022 on Personal Data Protection (PDP Law), independently determining the purposes and means of processing personal data. The document becomes necessary when organizations need to establish a formal framework for regular data sharing activities, ensuring compliance with Indonesian regulatory requirements, protecting data subject rights, and managing privacy risks. It includes detailed provisions on data security, breach notification, liability allocation, and compliance with cross-border data transfer restrictions where applicable. This agreement is particularly important given Indonesia's strengthened data protection regime and the significant penalties for non-compliance under the PDP Law.
Suggested Sections

1. Parties: Identification of the data controllers entering into the agreement, including their registration details and official addresses

2. Background: Context of the agreement, relationship between the parties, and purpose of the data sharing arrangement

3. Definitions: Detailed definitions of terms used throughout the agreement, including specific Indonesian law terminology

4. Purpose and Scope: Specific purposes for which personal data will be shared and processed, and the scope of data sharing activities

5. Roles and Responsibilities: Clear delineation of each controller's obligations and responsibilities in the data sharing arrangement

6. Categories of Personal Data: Specification of the types of personal data to be shared and processed

7. Legal Basis for Processing: Statement of the legal grounds for processing personal data under Indonesian law

8. Data Subject Rights: Procedures for handling data subject requests and ensuring compliance with data subject rights under the PDP Law

9. Security Measures: Required technical and organizational security measures for protecting shared personal data

10. Data Breach Notification: Procedures and timeframes for notifying each other and authorities of data breaches

11. Confidentiality: Obligations regarding the confidentiality of shared data and business information

12. Term and Termination: Duration of the agreement and conditions for termination

13. Governing Law and Jurisdiction: Specification of Indonesian law as governing law and jurisdiction for disputes

14. General Provisions: Standard contractual provisions including severability, entire agreement, and amendments

Optional Sections

1. Cross-border Data Transfers: Required when personal data will be transferred outside of Indonesia, including compliance with transfer requirements

2. Sector-Specific Compliance: Needed when data processing involves regulated sectors such as financial services or healthcare

3. Joint Processing Activities: Required when both controllers jointly determine the purposes and means of processing certain data

4. Audit Rights: Optional provisions for mutual audit rights to ensure compliance

5. Insurance Requirements: Specific insurance obligations when dealing with high-risk data processing

6. Data Protection Impact Assessment: Required when processing activities are likely to result in high risks to individuals

7. Sub-processing: Needed when either controller may engage sub-processors for data processing activities

Suggested Schedules

1. Description of Processing Activities: Detailed description of all data processing activities, including purposes, categories of data, and processing operations

2. Technical and Security Requirements: Specific technical and organizational security measures required for data processing

3. Data Transfer Procedures: Technical and operational procedures for secure data transfer between controllers

4. Contact Details and Escalation Matrix: List of key contacts and escalation procedures for operational and emergency situations

5. Standard Operating Procedures: Detailed procedures for routine operations and handling specific scenarios

6. Data Breach Response Plan: Detailed procedures and protocols for responding to data breaches

7. Data Subject Rights Procedures: Detailed procedures for handling data subject requests and exercising their rights

Authors

Alex Denne

Head of Growth (Open Source Law) @ Genie AI | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

Linkedin in social icon imageX social icon image
alex.den.21@genieai.co
Relevant legal definitions
Agreement
Applicable Data Protection Laws
Authorized Personnel
Business Day
Business Purpose
Confidential Information
Consent
Controller
Data Breach
Data Processing
Data Protection Impact Assessment
Data Protection Laws
Data Protection Officer
Data Sharing
Data Subject
Data Subject Rights
Effective Date
Electronic System
Force Majeure
Indonesian PDP Law
Information Security Incident
Intellectual Property Rights
Joint Processing Activities
Material Breach
Ministry of Communication and Information Technology
Personal Data
Processing Purposes
Recipient Controller
Regulatory Authority
Representative
Security Measures
Sensitive Personal Data
Services
Shared Personal Data
Special Categories of Personal Data
Sub-processor
Technical and Organizational Measures
Term
Third Party
Transfer
Clauses
Interpretations and Definitions
Subject Matter and Scope
Data Protection Obligations
Data Subject Rights
Confidentiality
Security Measures
Data Breach Notification
Cross-border Transfers
Audit Rights
Liability and Indemnification
Term and Termination
Data Retention and Deletion
Regulatory Compliance
Force Majeure
Assignment and Subcontracting
Notices
Governing Law
Dispute Resolution
Severability
Entire Agreement
Amendments
Warranties and Representations
Insurance
Costs and Expenses
Third Party Rights
Relationship of the Parties
Language Requirements
Relevant Industries

Financial Services

Healthcare

E-commerce

Technology

Insurance

Telecommunications

Education

Transportation and Logistics

Hospitality

Retail

Manufacturing

Professional Services

Relevant Teams

Legal

Compliance

Information Security

Data Protection

Risk Management

Information Technology

Operations

Privacy

Data Governance

Business Development

Regulatory Affairs

Relevant Roles

Chief Privacy Officer

Data Protection Officer

Legal Counsel

Compliance Manager

Information Security Manager

Risk Manager

Chief Information Security Officer

Chief Technology Officer

Privacy Manager

Chief Legal Officer

Compliance Director

Data Governance Manager

Information Technology Director

Operations Manager

Business Development Manager

Industries
Law No. 27 of 2022 on Personal Data Protection (PDP Law): Indonesia's comprehensive data protection law that establishes the fundamental rights of data subjects and obligations of data controllers, including requirements for legal data processing and transfer
Government Regulation No. 71 of 2019 on Electronic Systems and Transactions: Regulates electronic systems and transactions, including requirements for electronic system operators and data processing through electronic means
Law No. 11 of 2008 on Electronic Information and Transactions (ITE Law): Provides the legal framework for electronic transactions and information, including provisions on valid electronic documents and signatures
Indonesian Civil Code (KUHPerdata): Contains fundamental contract law principles that govern the formation and enforcement of agreements between parties
KOMINFO Regulation 20 of 2016 on Personal Data Protection: Specific regulation on personal data protection in electronic systems, including requirements for consent and data processing
Bank Indonesia Regulation No. 23/6/PBI/2021: Relevant if the agreement involves payment system data, establishing requirements for payment system data processing and protection
OJK Regulation No. 13/POJK.02/2018: Applicable if the agreement involves financial sector data, providing requirements for digital innovation in the financial services sector
Teams

Employer, Employee, Start Date, Job Title, Department, Location, Probationary Period, Notice Period, Salary, Overtime, Vacation Pay, Statutory Holidays, Benefits, Bonus, Expenses, Working Hours, Rest Breaks,  Leaves of Absence, Confidentiality, Intellectual Property, Non-Solicitation, Non-Competition, Code of Conduct, Termination,  Severance Pay, Governing Law, Entire Agreemen

Find the exact document you need

Personal Information Processing Agreement

An Indonesian law-governed agreement establishing terms for personal data processing between controller and processor, ensuring compliance with Indonesia's PDP Law.

find out more

DPA Data Processing Addendum

An Indonesian law-compliant Data Processing Addendum that governs personal data processing activities between controllers and processors under Indonesia's PDP Law.

find out more

Joint Controller Agreement

An agreement under Indonesian law governing the relationship between joint controllers who share responsibility for personal data processing.

find out more

Personal Data Agreement

An Indonesian law-compliant Personal Data Agreement establishing data processing roles and responsibilities under the 2022 PDP Law.

find out more

Data Processing Addendum

A legal agreement governing personal data processing activities under Indonesian law, ensuring compliance with the PDP Law and defining controller-processor obligations.

find out more

Third Party Processor Agreement

An Indonesian law-compliant agreement governing personal data processing activities between a data controller and third-party processor under UU PDP requirements.

find out more

Personal Data Collection Agreement

An Indonesian law-compliant agreement governing the collection and processing of personal data under the 2022 PDP Law.

find out more

Data Sharing Agreement Controller To Processor

An Indonesian law-governed agreement establishing terms for personal data processing between a controller and processor, compliant with Indonesia's PDP Law.

find out more

Controller To Controller Data Processing Agreement

An agreement governing personal data sharing between two controllers under Indonesian law, ensuring compliance with the PDP Law and related regulations.

find out more

Intra Group Data Transfer Agreement

An agreement governing intra-group data transfers in compliance with Indonesian data protection laws and regulations.

find out more

Data Controller To Data Controller Agreement

An Indonesian law-compliant agreement between two data controllers governing the sharing and processing of personal data under the PDP Law.

find out more

Controller To Controller DPA

An Indonesian law-compliant Controller to Controller DPA governing personal data sharing arrangements between independent data controllers.

find out more

DPA Agreement

An Indonesian law-compliant agreement governing personal data processing between controllers and processors, aligned with Indonesia's PDP Law requirements.

find out more

Third Party Data Processing Agreement

An Indonesian law-compliant agreement governing personal data processing arrangements between controllers and processors under the PDP Law 2022.

find out more

Personal Data Transfer Agreement

An agreement governing personal data transfers under Indonesian law, ensuring compliance with PDP Law requirements and data protection regulations.

find out more

Data Protection Agreement For Employees

An Indonesian law-compliant agreement governing the protection of employee personal data under the PDP Law and related regulations.

find out more

Sub Processing Agreement

An Indonesian law-governed agreement establishing terms for delegated data processing activities between a processor and sub-processor, ensuring compliance with Indonesian PDP Law.

find out more

International Data Transfer Agreement

An Indonesian law-compliant agreement governing the international transfer of personal data, ensuring compliance with UU PDP and related regulations.

find out more

Download our whitepaper on the future of AI in Legal

By providing your email address you are consenting to our Privacy Notice.
Thank you for downloading our whitepaper. This should arrive in your inbox shortly. In the meantime, why not jump straight to a section that interests you here: https://www.genieai.co/our-research
Oops! Something went wrong while submitting the form.

Genie’s Security Promise

Genie is the safest place to draft. Here’s how we prioritise your privacy and security.

Your documents are private:

We do not train on your data; Genie’s AI improves independently

All data stored on Genie is private to your organisation

Your documents are protected:

Your documents are protected by ultra-secure 256-bit encryption

Our bank-grade security infrastructure undergoes regular external audits

We are ISO27001 certified, so your data is secure

Organizational security

You retain IP ownership of your documents

You have full control over your data and who gets to see it

Innovation in privacy:

Genie partnered with the Computational Privacy Department at Imperial College London

Together, we ran a £1 million research project on privacy and anonymity in legal contracts

Want to know more?

Visit our Trust Centre for more details and real-time security updates.

Read our Privacy Policy.