Data Processing Clause (GDPR) template clause

Article [X] - Data Processing

1. In the performance of this Agreement, the Processor shall process personal data solely on behalf of and under the instructions of the Controller, in accordance with the General Data Protection Regulation (GDPR) and applicable national implementing legislation.

2. The processing concerns the following categories of personal data: [list, e.g. name, email address, job title, contract details] relating to the following categories of data subjects: [list, e.g. employees, customers, supplier contacts]. The processing is carried out for the following purposes: [list].

3. The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including at a minimum:
(a) encryption of personal data at rest and in transit;
(b) access controls on a need-to-know basis;
(c) periodic security audits and penetration tests;
(d) a procedure for regularly testing and evaluating the effectiveness of the measures.

4. The Processor shall not engage any sub-processor without the prior written consent of the Controller. The Processor shall impose on each sub-processor at least the same obligations as those set out in this Article.

5. The Processor shall notify the Controller of a personal data breach within [number, e.g. 24] hours of becoming aware of it, specifying the nature of the breach, the data affected, the estimated scope, and the measures taken or proposed.

6. Upon termination of this Agreement, the Processor shall, at the Controller's election, return or delete all personal data within [number] business days and confirm in writing that no copies have been retained, unless retention is required by law.