Controller Processor Agreement Template for United Arab Emirates

The Controller Processor Agreement is essential for organizations engaging in data processing activities within the UAE jurisdiction. This document is required under Federal Decree-Law No. 45/2021 whenever a data controller engages a processor to handle personal data on their behalf. The agreement ensures compliance with UAE data protection requirements, including specific provisions for data security, breach notification, and cross-border transfers. It's particularly important for businesses operating in UAE mainland and free zones, as it helps demonstrate compliance with local regulations while providing a framework for secure and lawful data processing activities. The agreement should be customized based on the specific processing activities, incorporating relevant requirements from both federal law and applicable free zone regulations.

1. Parties: Identification of the Data Controller and Data Processor, including full legal names, registration details, and addresses

2. Background: Context of the agreement, relationship between parties, and purpose of the data processing arrangement

3. Definitions: Key terms used in the agreement, aligned with UAE Federal Decree-Law No. 45/2021 terminology

4. Scope and Purpose of Processing: Detailed description of the data processing activities, categories of data, and processing purposes

5. Duration of Processing: Timeframe for the processing activities and agreement term

6. Obligations of the Data Controller: Controller's responsibilities including lawful basis for processing, instructions, and compliance with UAE law

7. Obligations of the Data Processor: Processor's duties including processing only on documented instructions, confidentiality, and security measures

8. Security Measures: Technical and organizational measures required to protect personal data as per UAE regulations

9. Sub-processing: Conditions and requirements for engaging sub-processors

10. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

11. Data Breach Notification: Procedures and timeframes for reporting data breaches as per UAE requirements

12. Audit Rights: Controller's right to audit and processor's obligation to demonstrate compliance

13. Data Transfer Restrictions: Rules for international data transfers under UAE law

14. Termination and Data Deletion: Provisions for agreement termination and data handling upon termination

15. Liability and Indemnification: Allocation of liability and indemnification obligations

16. Governing Law and Jurisdiction: Specification of UAE law as governing law and jurisdiction for disputes