Controller To Controller Agreement Template for Malaysia

The Controller to Controller Agreement is essential when two organizations, each acting as independent data controllers under Malaysian law, need to establish a framework for sharing personal data. This document becomes necessary when organizations need to transfer or share personal data for legitimate business purposes while ensuring compliance with the Personal Data Protection Act 2010 (PDPA) and related Malaysian regulations. The agreement covers crucial aspects such as data protection principles, security measures, breach notifications, and data subject rights management. It is particularly important in scenarios where both parties have independent control over the processing of personal data and need to clearly define their respective responsibilities and obligations under Malaysian data protection law.

1. Parties: Identification of the data controllers entering into the agreement, including registration details and addresses

2. Background: Context of the agreement, nature of data processing activities, and relationship between the parties

3. Definitions: Definitions of key terms used in the agreement, aligned with PDPA 2010 terminology

4. Scope and Purpose: Detailed description of the data sharing arrangement and legitimate purposes for data processing

5. Roles and Responsibilities: Specific obligations of each controller in relation to data processing and PDPA compliance

6. Data Protection Principles: Commitment to comply with PDPA principles including lawfulness, consent, and purpose limitation

7. Security Measures: Required technical and organizational measures to protect personal data

8. Data Subject Rights: Procedures for handling data subject requests and ensuring rights under PDPA

9. Breach Notification: Procedures for notifying each other and authorities of data breaches

10. Confidentiality: Obligations regarding confidentiality of shared personal data

11. Term and Termination: Duration of the agreement and circumstances for termination

12. Return or Deletion of Data: Obligations regarding data handling upon termination

13. Liability and Indemnities: Allocation of risks and responsibilities between parties

14. General Provisions: Standard contractual clauses including governing law, jurisdiction, and amendment procedures