Data Processing Addendum Template for Philippines

The Data Processing Addendum (DPA) is a critical legal document required whenever an organization (data controller) engages another party (data processor) to process personal data on its behalf in the Philippines. This document supplements the main service agreement between parties and ensures compliance with the Philippine Data Privacy Act of 2012 and its implementing rules. The DPA becomes particularly important in contexts involving outsourcing, cloud services, or any third-party data processing arrangements. It details specific requirements for data security, breach notification procedures, cross-border transfers, and data subject rights management. The document is essential for demonstrating compliance with Philippine privacy laws and protecting both parties' interests in data processing activities.

1. Parties: Identification of the data controller and data processor, including their registered addresses and authorized representatives

2. Background: Context of the relationship between parties and reference to the main agreement this DPA supplements

3. Definitions: Key terms used in the agreement, aligned with definitions from the Data Privacy Act of 2012

4. Scope and Purpose: Details of the data processing activities covered by the agreement

5. Obligations of the Data Processor: Core responsibilities of the processor including security measures, confidentiality, and processing limitations

6. Obligations of the Data Controller: Responsibilities of the controller including lawful basis for processing and instructions

7. Data Subject Rights: Procedures for handling data subject requests and ensuring compliance with their rights

8. Data Security: Required security measures and protocols for protecting personal data

9. Data Breach Notification: Procedures and timeframes for reporting and handling data breaches

10. Audit Rights: Controller's rights to audit the processor's compliance and related procedures

11. Cross-border Data Transfers: Rules and safeguards for international data transfers

12. Term and Termination: Duration of the agreement and conditions for termination

13. Return or Deletion of Data: Obligations regarding personal data upon contract termination

14. Governing Law and Jurisdiction: Specification of Philippine law as governing law and jurisdiction for disputes