Controller Processor Agreement Template for Australia

The Controller Processor Agreement is essential for organizations operating in Australia that outsource the processing of personal data to third parties. This document is required when one party (the controller) engages another party (the processor) to perform data processing activities on its behalf. The agreement ensures compliance with the Privacy Act 1988, Australian Privacy Principles, and related privacy regulations. It details the scope of processing activities, security measures, data breach protocols, and compliance requirements. The document is particularly crucial given Australia's strict privacy regime and the significant penalties for non-compliance. It should be used whenever an organization engages external parties to process personal data, whether for cloud services, analytics, payroll processing, or other data handling activities.

1. Parties: Identification of the Data Controller and Data Processor, including full legal names and registered addresses

2. Background: Context of the agreement, relationship between parties, and purpose of data processing activities

3. Definitions: Detailed definitions of key terms used throughout the agreement, including 'Personal Data', 'Processing', 'Data Subject', etc.

4. Scope and Purpose of Processing: Detailed description of the authorized data processing activities and their specific purposes

5. Duration of Agreement: Term of the agreement, including commencement date and termination provisions

6. Nature and Purpose of Processing: Specific details about the types of processing activities and their intended purposes

7. Obligations of the Data Processor: Core responsibilities of the processor including processing only on documented instructions, confidentiality, security measures

8. Obligations of the Data Controller: Responsibilities of the controller including providing documented instructions and ensuring legal basis for processing

9. Security Measures: Technical and organizational security measures required to protect personal data

10. Sub-processing: Conditions and requirements for engaging sub-processors

11. Data Breach Notification: Procedures and timeframes for reporting data breaches

12. Audit Rights: Controller's rights to audit the processor's compliance and processor's obligations to assist

13. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests

14. Cross-border Data Transfers: Requirements and safeguards for international data transfers

15. Termination and Data Deletion: Procedures for agreement termination and subsequent handling of personal data

16. Governing Law and Jurisdiction: Specification of Australian law as governing law and jurisdiction for disputes