Controller Processor Agreement Template for the Netherlands

When you engage a third-party service provider to process personal data on behalf of your organization in the Netherlands, you need a Controller Processor Agreement to ensure GDPR compliance. This legally binding contract establishes the framework for data processing relationships, defining clear responsibilities between the data controller (your organization) and the data processor (the service provider).

When do you need this document?

You must have a Controller Processor Agreement in place whenever you outsource data processing activities to external providers. This includes engaging cloud service providers for data storage, hiring marketing agencies to manage customer databases, using payroll companies to process employee information, or contracting IT support services that access personal data. The agreement is also required when working with sub-processors, such as when your primary processor engages additional third parties. Under Dutch law, this contract must be executed before any processing activities begin, and failure to have proper agreements in place can result in significant fines from the Autoriteit Persoonsgegevens.

Key legal considerations

Your Controller Processor Agreement must include specific mandatory elements under GDPR Article 28. These include detailed descriptions of processing activities, categories of personal data involved, and retention periods. The contract must specify security measures, breach notification procedures within 72 hours, and audit rights allowing you to verify compliance. Data transfer provisions are crucial if processing occurs outside the EU, requiring incorporation of Standard Contractual Clauses or adequacy decisions. The agreement should address processor liability limitations, indemnification clauses, and termination procedures including data return or destruction. You must also consider sub-processing arrangements, ensuring your processor obtains written authorization before engaging additional processors and maintains the same level of data protection.

Legal requirements in Netherlands

Under the Dutch GDPR Implementation Act (UAVG), Controller Processor Agreements must comply with specific national requirements alongside GDPR provisions. The Autoriteit Persoonsgegevens emphasizes that contracts must be written in clear, accessible language and include explicit references to Dutch jurisdiction for dispute resolution. When processing involves cross-border transfers, you must ensure compliance with both EU Standard Contractual Clauses and any additional Dutch safeguards. The agreement must specify applicable Dutch Civil Code provisions for contract validity and enforcement. Organizations processing telecommunications data must also consider requirements under the Dutch Telecommunications Act. The contract should designate authorized representatives within the Netherlands if either party lacks EU establishment, and include specific provisions for cooperation with Dutch supervisory authorities during investigations or audits.