Controller To Controller DPA Template for Philippines

The Controller to Controller DPA is essential when two organizations, each acting as independent data controllers under Philippine law, need to share personal data with each other. This agreement is specifically designed to comply with the requirements of the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, as well as relevant National Privacy Commission (NPC) issuances. It should be used whenever two organizations need to establish a formal framework for sharing personal data while maintaining independent control over the processing activities. The agreement covers crucial aspects such as data protection responsibilities, security measures, breach notification procedures, and compliance mechanisms. It's particularly important given the strict data protection requirements in the Philippines and the potential penalties for non-compliance with data privacy regulations.

1. Parties: Identification of the data controllers entering into the agreement, including their registered addresses and company details

2. Background: Context of the data sharing relationship and purpose of the agreement

3. Definitions: Definitions of key terms used in the agreement, aligned with the Data Privacy Act of 2012

4. Scope and Purpose of Data Sharing: Details of the personal data to be shared and the specific purposes for sharing

5. Roles and Responsibilities: Specific obligations and responsibilities of each controller in relation to the shared personal data

6. Legal Basis for Processing: Identification of the legal grounds under Philippine law for processing and sharing the personal data

7. Data Protection Principles: Commitment to comply with the data protection principles under Philippine law

8. Data Subject Rights: Procedures for handling data subject requests and ensuring data subject rights are respected

9. Security Measures: Technical and organizational measures required to protect the shared personal data

10. Data Breach Notification: Procedures for notifying each other and the NPC of any personal data breaches

11. Confidentiality: Obligations to maintain confidentiality of the shared personal data

12. Term and Termination: Duration of the agreement and conditions for termination

13. Governing Law and Jurisdiction: Specification of Philippine law as governing law and jurisdiction for disputes

14. General Provisions: Standard contractual provisions including severability, entire agreement, and amendments