Third Party Data Processing Agreement Template for Australia

This Third Party Data Processing Agreement is essential when an organization (data controller) engages a service provider (data processor) to process personal information on its behalf in Australia. The agreement is designed to comply with the Privacy Act 1988 (Cth), Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme. It should be used whenever personal information is processed by third parties, whether for cloud services, data analytics, payment processing, or other services. The document ensures proper data handling, security measures, and breach notification procedures while addressing specific Australian legal requirements, including cross-border data transfers and mandatory breach reporting obligations. It's particularly important given the significant penalties for privacy breaches under Australian law and the increasing regulatory focus on third-party data handling arrangements.

1. Parties: Identification of the data controller and data processor, including registered addresses and company details

2. Background: Context of the agreement, relationship between parties, and purpose of data processing

3. Definitions: Definitions of key terms aligned with Privacy Act 1988 and APPs, including 'personal information', 'sensitive information', 'data breach', etc.

4. Scope and Purpose: Detailed description of data processing activities, types of data, and permitted purposes

5. Data Processor Obligations: Core obligations including processing only on documented instructions, maintaining confidentiality, implementing security measures

6. Data Security: Specific security measures required to protect personal information in accordance with APP 11

7. Subprocessing: Conditions and requirements for engaging subprocessors, including approval process

8. Data Breach Notification: Procedures for handling and reporting data breaches under the NDB scheme

9. Audit Rights: Controller's rights to audit processor's compliance and processor's obligations to demonstrate compliance

10. Data Subject Rights: Processor's obligations to assist controller in responding to individual rights requests

11. Term and Termination: Duration of agreement, termination conditions, and data handling upon termination

12. Liability and Indemnities: Allocation of liability and indemnification obligations between parties

13. General Provisions: Standard contractual provisions including governing law, jurisdiction, and entire agreement