Data Privacy Addendum Template for Denmark

The Data Privacy Addendum is a critical legal document required whenever a business relationship involves the processing of personal data under Danish jurisdiction. It supplements existing service agreements to ensure compliance with the General Data Protection Regulation (GDPR) and Danish data protection laws. This document becomes necessary when one party (the data processor) processes personal data on behalf of another party (the data controller), establishing clear responsibilities, security requirements, and compliance obligations. The addendum is particularly important in the Danish context as it must address specific requirements under the Danish Data Protection Act while maintaining alignment with broader EU data protection principles. It includes detailed provisions for data handling, security measures, breach notifications, and international data transfers, making it essential for any business relationship involving personal data processing in Denmark.

1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses

2. Background: Context of the DPA, reference to the main agreement, and purpose of the addendum

3. Definitions: Key terms used in the DPA, including those from GDPR and Danish Data Protection Act

4. Scope and Purpose of Processing: Details of what personal data will be processed, for what purposes, and the duration of processing

5. Obligations of the Data Processor: Core responsibilities of the processor including security measures, confidentiality, and cooperation requirements

6. Sub-processors: Rules for appointment and management of sub-processors, including authorization requirements

7. Data Subject Rights: Processes for handling data subject requests and processor's assistance obligations

8. Data Security: Required technical and organizational security measures

9. Personal Data Breach: Procedures for breach notification and management

10. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

11. Cross-border Data Transfers: Rules and safeguards for international data transfers

12. Term and Termination: Duration of the DPA and procedures for termination

13. Return or Deletion of Data: Obligations regarding personal data upon termination of services

14. Liability and Indemnification: Allocation of responsibility and liability between parties

15. Governing Law and Jurisdiction: Specification of Danish law as governing law and jurisdiction for disputes