Supplier Data Processing Agreement Template for Philippines

The Supplier Data Processing Agreement is a critical legal document required when a company (Data Controller) engages a supplier (Data Processor) to process personal data on its behalf in the Philippines. This agreement is essential for compliance with the Data Privacy Act of 2012 and its Implementing Rules and Regulations. It should be used whenever a business relationship involves the outsourcing of personal data processing activities, whether for cloud services, IT support, HR management, or any other services involving personal data handling. The agreement details specific obligations for data protection, security measures, breach notification procedures, and compliance requirements. It is particularly important in the Philippine context, where strict data privacy regulations require formal documentation of data processing relationships and clear allocation of responsibilities between controllers and processors.

1. Parties: Identification of the Data Controller and Data Processor, including their registered addresses and authorized representatives

2. Background: Context of the agreement, relationship between parties, and purpose of data processing activities

3. Definitions: Definitions of key terms used in the agreement, aligned with the Data Privacy Act of 2012 terminology

4. Scope and Purpose of Processing: Detailed description of the data processing activities, types of personal data, and purposes of processing

5. Obligations of the Data Processor: Core responsibilities of the processor including security measures, confidentiality, and compliance with instructions

6. Obligations of the Data Controller: Responsibilities of the controller including providing clear instructions and ensuring lawful basis for processing

7. Technical and Organizational Measures: Security measures required to protect personal data as per Philippine regulations

8. Sub-processing: Conditions and requirements for engaging sub-processors

9. Data Subject Rights: Procedures for handling data subject requests and assisting the controller

10. Personal Data Breach Management: Procedures for detecting, reporting, and handling data breaches

11. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

12. Data Transfer Requirements: Rules for transferring data, especially cross-border transfers

13. Term and Termination: Duration of the agreement and termination conditions

14. Return or Deletion of Data: Obligations regarding personal data upon termination

15. Liability and Indemnities: Allocation of liability and indemnification obligations

16. Governing Law and Jurisdiction: Specification of Philippine law as governing law and jurisdiction for disputes