Sub Processing Agreement Template for Ireland

The Sub Processing Agreement is essential when a data processor needs to engage another entity to process personal data on behalf of a data controller. This document is particularly crucial in the Irish business environment, where organizations must comply with both EU GDPR and Irish data protection laws. It should be used whenever a processor intends to delegate any data processing activities to a third party, ensuring that appropriate safeguards are in place for personal data protection. The agreement includes detailed provisions on data security, breach notification procedures, audit rights, and data subject rights, tailored to meet Irish legal requirements. It also addresses specific obligations under Article 28 of the GDPR regarding the processor-sub-processor relationship, including requirements for written authorization and contractual terms that flow down data protection obligations.

1. Parties: Identification of the main processor (as client) and the sub-processor (as service provider), including full legal names and registered addresses

2. Background: Context of the agreement, reference to the main processing agreement, and the need for sub-processing services

3. Definitions: Definitions of key terms used in the agreement, including GDPR-specific terminology and agreement-specific terms

4. Scope and Purpose: Details of the specific processing activities to be carried out by the sub-processor

5. Duration: Term of the agreement, including commencement date and termination provisions

6. Sub-processor Obligations: Core obligations including data processing instructions, confidentiality, security measures, and compliance with GDPR

7. Technical and Organizational Measures: Security requirements and specific measures to be implemented by the sub-processor

8. Audit Rights: Rights of the processor and controller to audit the sub-processor's compliance

9. Data Breach Notification: Procedures and timeframes for reporting data breaches

10. Assistance and Cooperation: Sub-processor's obligations to assist with data subject requests and regulatory compliance

11. Return or Deletion of Data: Obligations regarding data handling upon termination of services

12. Liability and Indemnities: Allocation of risk and responsibility between parties

13. General Provisions: Standard contractual terms including governing law, jurisdiction, and amendment procedures