Sub Processing Agreement Template for Australia

The Sub Processing Agreement is essential in modern data processing arrangements where organizations need to delegate data processing activities to additional service providers. This document is particularly relevant in Australia, where the Privacy Act 1988 and Australian Privacy Principles create specific obligations for entities handling personal information. The agreement is typically used when a data processor (who processes data on behalf of a data controller) needs to engage another party (sub-processor) to assist with processing activities. It establishes clear chains of responsibility, ensures compliance with privacy laws, and sets out specific technical and organizational measures for data protection. The Sub Processing Agreement becomes crucial when organizations are handling sensitive data, operating in regulated industries, or engaging in cross-border data transfers, as it helps maintain compliance and manage risk throughout the data processing chain.

1. Parties: Identification of the main contractor (processor) and the sub-processor

2. Background: Context of the agreement, reference to the main processing agreement, and the need for sub-processing

3. Definitions: Key terms used throughout the agreement, including data protection specific terminology

4. Scope and Purpose: Detailed description of the sub-processing services and permitted processing activities

5. Obligations of the Sub-processor: Core responsibilities including compliance with instructions, confidentiality, and security measures

6. Technical and Organizational Measures: Security requirements and specific measures for data protection

7. Data Breach Notification: Procedures and timeframes for reporting data breaches

8. Audit Rights: Rights of the processor and controller to audit the sub-processor

9. International Data Transfers: Rules and safeguards for cross-border data transfers

10. Confidentiality: Confidentiality obligations and handling of sensitive information

11. Term and Termination: Duration of the agreement and termination provisions

12. Return or Deletion of Data: Obligations regarding data handling upon contract termination

13. Liability and Indemnities: Allocation of risk and responsibility between parties

14. General Provisions: Standard contractual terms including governing law, jurisdiction, and amendments