Commissioned Data Processing Agreement Template for Netherlands

A Commissioned Data Processing Agreement is required under Article 28 GDPR whenever an organization (controller) engages another party (processor) to process personal data on its behalf. This document, governed by Dutch law, establishes the mandatory framework for such processing activities, ensuring compliance with both GDPR and Dutch data protection requirements. It details the processor's obligations, security measures, data handling procedures, and compliance mechanisms. The agreement is essential for Dutch businesses and international organizations processing personal data in the Netherlands, as it incorporates specific requirements from the Dutch GDPR Implementation Act (UAVG) and guidance from the Dutch Data Protection Authority. The Commissioned Data Processing Agreement should be put in place before any processing activities commence and should be regularly reviewed to ensure continued compliance with evolving data protection standards.

1. Parties: Identification of the data controller and data processor, including full legal names, registration numbers, and authorized representatives

2. Background: Context of the processing relationship, reference to main service agreement, and purpose of this DPA

3. Definitions: Definitions of key terms used in the agreement, including those from GDPR Article 4 and additional contract-specific terms

4. Scope and Purpose of Processing: Detailed description of the processing activities, categories of data subjects, and types of personal data

5. Duration and Termination: Term of the agreement, termination conditions, and data handling upon termination

6. Processor Obligations: Core obligations of the processor including processing only on documented instructions, confidentiality, security measures, and data breach notification

7. Sub-processing: Conditions and requirements for engaging sub-processors, including authorization process and obligations

8. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests

9. Security Measures: Technical and organizational measures required to ensure appropriate security of processing

10. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

11. Data Transfers: Rules and safeguards for international data transfers, including to countries outside the EEA

12. Liability and Indemnification: Allocation of liability between parties and indemnification obligations

13. Governing Law and Jurisdiction: Specification of Dutch law as governing law and jurisdiction for disputes