Controller Processor Agreement Template for Philippines

The Controller Processor Agreement is essential for organizations operating in the Philippines that engage in the processing of personal data through third parties. This document is required under the Philippine Data Privacy Act of 2012 whenever a data controller delegates processing activities to a data processor. The agreement must detail the scope of processing activities, security requirements, confidentiality obligations, and compliance mechanisms. It serves as a crucial compliance tool, ensuring that both parties understand their obligations under Philippine data protection law and establishing clear accountability for data processing operations. The document typically includes specific provisions for data security measures, breach notification procedures, audit rights, and data subject rights management, all tailored to meet Philippine regulatory requirements.

1. Parties: Identification of the Data Controller and Data Processor, including their registered addresses and authorized representatives

2. Background: Context of the agreement, relationship between parties, and purpose of the data processing arrangement

3. Definitions: Key terms used in the agreement, including those defined in the Data Privacy Act and additional contract-specific terms

4. Scope and Purpose of Processing: Detailed description of the processing activities, categories of data, and purposes of processing

5. Duration of Processing: Term of the agreement and processing activities, including conditions for renewal

6. Obligations of the Data Controller: Controller's responsibilities including providing instructions, ensuring legal basis for processing, and maintaining compliance

7. Obligations of the Data Processor: Processor's duties including processing only on documented instructions, maintaining confidentiality, and implementing security measures

8. Technical and Organizational Measures: Security measures required to protect personal data during processing

9. Sub-processing: Conditions and requirements for engaging sub-processors

10. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

11. Personal Data Breach Management: Procedures for breach notification and management

12. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

13. Data Return and Deletion: Requirements for handling data upon termination of services

14. Liability and Indemnification: Allocation of responsibility and liability between parties

15. Termination: Conditions and procedures for terminating the agreement

16. Governing Law and Jurisdiction: Specification of Philippine law as governing law and jurisdiction for disputes