Data Sharing Agreement Controller To Processor Template for United Arab Emirates

This Data Sharing Agreement Controller To Processor is essential for organizations operating under UAE jurisdiction that engage third parties to process personal data on their behalf. The agreement ensures compliance with UAE Federal Decree-Law No. 45/2021 and its Executive Regulations, which mandate specific requirements for controller-processor relationships. It should be used whenever a data controller outsources personal data processing activities to a third-party processor, whether for services such as cloud storage, payment processing, HR management, or other data processing activities. The document includes crucial provisions for data security, confidentiality, breach notification, audit rights, and data subject rights management, while also addressing specific UAE regulatory requirements such as data localization and cross-border transfer restrictions where applicable.

1. Parties: Identification of the Data Controller and Data Processor, including full legal names, registration details, and addresses

2. Background: Context of the data sharing arrangement, relationship between parties, and purpose of the agreement

3. Definitions: Definitions of key terms used in the agreement, aligned with UAE Federal Decree-Law No. 45/2021 terminology

4. Scope and Purpose of Processing: Detailed description of the data processing activities, categories of data, and purposes of processing

5. Duration of Processing: Term of the agreement and processing activities, including renewal provisions

6. Obligations of the Data Controller: Controller's responsibilities, including lawful basis for processing, instructions to processor, and oversight duties

7. Obligations of the Data Processor: Processor's duties including processing only on documented instructions, confidentiality, security measures, and subprocessing restrictions

8. Data Security Measures: Technical and organizational security measures required under UAE law and industry standards

9. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

10. Personal Data Breach Management: Breach notification procedures, response protocols, and cooperation requirements

11. Audit Rights and Compliance: Controller's audit rights and processor's compliance demonstration obligations

12. Liability and Indemnification: Allocation of liability and indemnification obligations between parties

13. Termination: Termination circumstances, notice periods, and data deletion/return obligations

14. Governing Law and Jurisdiction: Specification of UAE law as governing law and jurisdiction for disputes