DPA Data Processing Addendum Generator for Australia

A Data Processing Addendum (DPA) is essential when an organization (data controller) engages another party (data processor) to process personal information on its behalf in Australia. This document is required to comply with the Privacy Act 1988 and Australian Privacy Principles, particularly when the main service agreement doesn't adequately address data protection requirements. The DPA establishes specific obligations regarding data security, breach notification, cross-border transfers, and sub-processing arrangements. It's particularly crucial for cloud services, outsourcing arrangements, and any services involving personal information processing. The document helps organizations demonstrate compliance with Australian privacy laws and establishes clear accountability for data protection responsibilities.

1. Parties: Identification of the data controller (client) and data processor (service provider), including their registered addresses and company details

2. Background: Context of the DPA, reference to the main service agreement, and purpose of the data processing addendum

3. Definitions: Key terms used in the DPA, including 'Personal Information', 'Processing', 'Data Subject', 'Privacy Laws', etc.

4. Scope and Purpose of Processing: Detailed description of the data processing activities, types of personal information, and purposes for which data will be processed

5. Obligations of the Data Processor: Core responsibilities of the processor including processing only on documented instructions, confidentiality, security measures, and breach notification

6. Obligations of the Data Controller: Responsibilities of the controller including lawful basis for processing, accuracy of data, and providing documented instructions

7. Security Measures: Technical and organizational security measures required to protect personal information

8. Sub-processing: Conditions and requirements for engaging sub-processors, including notification and approval processes

9. Data Breach Notification: Procedures for handling and reporting data breaches in accordance with the Notifiable Data Breaches scheme

10. Cross-border Data Transfers: Requirements and safeguards for international data transfers under APP 8

11. Audit Rights: Controller's rights to audit the processor's compliance with the DPA

12. Term and Termination: Duration of the DPA and conditions for termination

13. Return or Deletion of Data: Obligations regarding personal information upon termination of services