Data Processing Agreement Template for New Zealand

Use a Data Processing Agreement any time your organization shares personal data with external service providers or vendors. This includes common scenarios like hiring cloud storage providers, using online marketing tools, outsourcing payroll processing, or working with IT consultants who can access your customer database.

Under New Zealand's Privacy Act 2020, you need this agreement before letting third parties process sensitive information about your customers or employees. It's particularly crucial when sharing data with overseas providers, using new software platforms, or scaling up operations that involve customer data. Getting it in place early protects your organization and builds trust with your data partners.

• DPA Agreement: Standard agreement for domestic data processing, covering basic privacy and security requirements under NZ law
• Data Transfer Addendum: Additional terms for sending data overseas, especially important for cloud services
• Data Processing Addendum: Supplements existing contracts with detailed processing rules and safeguards
• Data Protection Addendum: Focuses on specific security measures and breach response protocols
• International Data Transfer Agreement: Comprehensive agreement for global data flows, meeting multiple jurisdictions' requirements

• Data Controllers: NZ businesses and organizations who collect personal information and need others to process it, like retailers with customer databases
• Data Processors: Service providers who handle data on behalf of controllers, such as cloud storage companies or marketing agencies
• Privacy Officers: Internal compliance staff who oversee data protection and often draft or review these agreements
• Legal Counsel: Lawyers who draft and negotiate the agreements to ensure compliance with the Privacy Act 2020
• IT Managers: Technical staff who implement the security measures and data handling procedures specified in the agreement

• Data Inventory: List all types of personal information being shared, including customer details, employee records, or sensitive data
• Processing Details: Document exactly how the data will be used, stored, and protected by the service provider
• Security Measures: Specify required safeguards, encryption standards, and access controls that align with NZ Privacy Act requirements
• Party Information: Gather full legal names, contact details, and roles of all organizations involved
• Breach Procedures: Plan response protocols and notification requirements for potential data incidents
• Review Framework: Set up monitoring schedules and compliance checkpoints to keep the agreement current

• Identification Section: Full legal names and roles of both data controller and processor, plus contact details
• Processing Scope: Detailed description of what data is being processed and for what specific purposes
• Security Measures: Specific technical and organizational safeguards meeting Privacy Act 2020 requirements
• Confidentiality Terms: Obligations for staff handling data and access restrictions
• Cross-border Rules: Requirements for international data transfers and storage locations
• Breach Protocol: Notification procedures and response timelines for data incidents
• Termination Rights: Clear conditions for ending the agreement and returning or deleting data

A Data Processing Agreement differs significantly from a Data Sharing Agreement in several key ways. While both deal with personal information, they serve distinct purposes under New Zealand's Privacy Act 2020.

• Primary Purpose: Data Processing Agreements govern how a service provider handles data on behalf of another organization, while Data Sharing Agreements cover the mutual exchange of information between equal partners
• Relationship Structure: Processing agreements create a controller-processor relationship with clear hierarchies, whereas sharing agreements establish peer-to-peer arrangements
• Scope of Control: Processing agreements limit the processor's use of data to specific instructions, but sharing agreements often grant both parties more autonomy in data usage
• Compliance Focus: Processing agreements emphasize security measures and processing limitations, while sharing agreements concentrate on mutual obligations and joint privacy responsibilities