Standard Data Processing Agreement Template for Philippines

The Standard Data Processing Agreement is a crucial legal document required under Philippine law when an organization (the data controller) engages another party (the data processor) to process personal data on its behalf. This agreement is mandated by the Data Privacy Act of 2012 and its Implementing Rules and Regulations, supervised by the National Privacy Commission. The document serves to establish clear responsibilities, security requirements, and compliance obligations for both parties. It is particularly important in the Philippine context where data privacy regulations impose strict requirements on cross-border data transfers and processing operations. The agreement must address specific local requirements while ensuring practical operational efficiency in data processing activities.

1. Parties: Identification of the Data Controller and Data Processor, including their complete legal names, addresses, and registration details

2. Background: Context of the agreement, nature of the business relationship, and brief description of the data processing activities

3. Definitions: Key terms used in the agreement, aligned with definitions from the Data Privacy Act of 2012 and other relevant Philippine regulations

4. Scope and Purpose of Processing: Detailed description of the permitted data processing activities, types of personal data involved, and processing purposes

5. Obligations of the Data Controller: Responsibilities of the controller including providing clear instructions, ensuring legal basis for processing, and maintaining records

6. Obligations of the Data Processor: Core responsibilities of the processor including following instructions, maintaining confidentiality, and implementing security measures

7. Security Measures: Technical and organizational measures required to protect personal data, aligned with Philippine privacy law requirements

8. Sub-processing: Conditions and requirements for engaging sub-processors, including approval processes and flow-down obligations

9. Data Subject Rights: Procedures for handling data subject requests and supporting the controller in fulfilling data subject rights

10. Personal Data Breach Management: Breach notification procedures, timing requirements, and cooperation obligations aligned with NPC guidelines

11. Audit and Compliance: Rights of the controller to audit the processor and requirements for demonstrating compliance

12. Term and Termination: Duration of the agreement, termination rights, and data handling obligations upon termination

13. Governing Law and Jurisdiction: Specification of Philippine law as governing law and jurisdiction for dispute resolution