Intercompany Data Processing Agreement Template for Denmark

An Intercompany Data Processing Agreement is essential when personal data is processed between different entities within the same corporate group under Danish jurisdiction. This document is required to comply with Article 28 of the GDPR and the Danish Data Protection Act, ensuring proper documentation of data processing activities between group entities. It should be used whenever one group entity processes personal data on behalf of another group entity, establishing clear controller-processor relationships. The agreement includes specific provisions required by Danish law, details of processing activities, security measures, and compliance requirements. It is particularly important for multinational organizations with Danish operations or companies subject to Danish data protection regulations, as it helps demonstrate compliance with legal requirements while maintaining efficient intra-group data flows.

1. Parties: Identification of the data controller and data processor entities within the company group

2. Background: Context of the agreement and the relationship between the group entities

3. Definitions: Key terms used in the agreement, including GDPR-specific terminology

4. Scope and Purpose: Details of the processing activities covered by the agreement

5. Duration: Term of the agreement and conditions for termination

6. Nature and Purpose of Processing: Detailed description of why and how personal data will be processed

7. Types of Personal Data and Categories of Data Subjects: Specification of the personal data types and individuals affected

8. Obligations of the Data Controller: Responsibilities and duties of the controlling entity

9. Obligations of the Data Processor: Processor's commitments including security, confidentiality, and assistance requirements

10. Sub-processing: Conditions and requirements for engaging sub-processors

11. Security of Processing: Technical and organizational security measures

12. Data Subject Rights: Procedures for handling data subject requests

13. Personal Data Breaches: Breach notification and management procedures

14. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

15. Return or Deletion of Data: Procedures for data handling upon agreement termination

16. Liability and Indemnification: Allocation of responsibilities and liability between parties

17. Governing Law and Jurisdiction: Specification of Danish law application and jurisdiction