Data Protection Addendum Template for Denmark

A Data Protection Addendum (DPA) is a mandatory legal document required under both EU GDPR and Danish data protection law whenever a company (controller) engages another party (processor) to process personal data on its behalf. This document supplements the main service agreement between parties and specifically addresses data protection obligations. It must comply with Article 28 of the GDPR and additional requirements under the Danish Data Protection Act. The DPA includes essential provisions regarding data security measures, breach notifications, sub-processor appointments, and international data transfers. It's particularly crucial in the Danish context as it must address specific local regulatory requirements while maintaining alignment with broader EU data protection principles.

1. Parties: Identification of the data controller and data processor, including full legal names and registration details

2. Background: Context of the relationship between parties and reference to the main service agreement this DPA supplements

3. Definitions: Key terms used in the DPA, including those from GDPR and Danish Data Protection Act

4. Scope and Purpose: Details of the types of personal data being processed and the purposes of processing

5. Duration: Term of the DPA, typically linked to the main agreement's duration

6. Nature and Purpose of Processing: Detailed description of how and why the data will be processed

7. Processor Obligations: Core obligations of the processor under GDPR Article 28 and Danish law

8. Sub-processing: Conditions and requirements for engaging sub-processors

9. Technical and Organizational Measures: Security measures required to protect personal data

10. Data Subject Rights: Processor's obligations to assist with data subject requests

11. Personal Data Breach: Notification requirements and procedures for handling data breaches

12. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

13. Return or Deletion of Data: Requirements for data handling upon agreement termination

14. Liability and Indemnification: Allocation of responsibilities and liabilities between parties

15. Governing Law and Jurisdiction: Specification of Danish law as governing law and jurisdiction