Supplier Data Processing Agreement Template for Australia

A Supplier Data Processing Agreement is essential when an organization engages a supplier to process personal information on its behalf. This document is specifically designed for use in Australia and ensures compliance with the Privacy Act 1988, Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme. It should be used whenever a supplier will have access to, store, or process personal information controlled by the organization. The agreement includes detailed provisions on data security, breach notification, audit rights, and data handling obligations. It is particularly important given the increasing focus on data protection and privacy compliance in Australia, and the significant penalties for privacy breaches. The document addresses both domestic and international data processing considerations, making it suitable for Australian businesses engaging local or overseas suppliers.

1. Parties: Identification of the data controller (organization) and data processor (supplier), including full legal names and registered addresses

2. Background: Context of the agreement, relationship between parties, and general purpose of the data processing activities

3. Definitions: Detailed definitions of key terms used throughout the agreement, including 'Personal Information', 'Processing', 'Data Breach', and other relevant terms

4. Scope and Purpose of Processing: Detailed description of the authorized data processing activities, types of personal information involved, and permitted purposes

5. Obligations of the Processor: Core responsibilities of the supplier including processing only on documented instructions, maintaining confidentiality, and implementing security measures

6. Security Requirements: Specific technical and organizational measures required to ensure appropriate security of personal information

7. Sub-processing: Conditions and requirements for engaging sub-processors, including approval processes and flow-down obligations

8. Data Breach Notification: Procedures and timeframes for reporting data breaches, including obligations under the Notifiable Data Breaches scheme

9. Audit Rights: Controller's rights to audit the processor's compliance and processor's obligations to provide information and assistance

10. Data Subject Rights: Processor's obligations to assist the controller in responding to data subject requests and ensuring data subject rights

11. Term and Termination: Duration of the agreement, termination circumstances, and data handling obligations upon termination

12. Return or Destruction of Data: Requirements for handling personal information after contract termination or upon controller's request

13. Liability and Indemnities: Allocation of liability between parties and indemnification obligations

14. General Provisions: Standard contractual provisions including governing law, jurisdiction, and entire agreement