Controller To Controller Dpa Template for United States

Create a bespoke document in minutes, or upload and review your own.

4.6 / 5

4.8 / 5

Let's create your Controller To Controller Dpa

1. Select your governing law and document type:

2. Enter your key requirements:

3. Create your document to edit, review or download

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

Controller To Controller Dpa

"I need a Controller-to-Controller DPA to govern data sharing between my healthcare tech company and a research institution in California, ensuring HIPAA compliance and covering patient data transfer starting March 2025."

Document background

The Controller-to-Controller DPA is essential when two organizations need to share personal data while maintaining independent control over the processing activities. This document is particularly crucial in the United States, where organizations must navigate complex federal and state privacy regulations. The agreement specifies each party's obligations regarding data protection, security measures, breach notification procedures, and compliance with various privacy laws. It should be used whenever two controllers plan to share personal data on a regular basis or for specific projects, ensuring clear allocation of responsibilities and compliance with applicable regulations.

Suggested Sections

1. Parties: Identification of both controllers and their legal details

2. Background: Context of data sharing relationship and purpose

3. Definitions: Key terms including data categories, processing activities, and regulatory references

4. Scope and Purpose: Details of data sharing arrangement and legitimate purposes

5. Obligations of the Parties: Mutual responsibilities for data protection

6. Data Security Measures: Required security controls and standards

7. Data Subject Rights: Procedures for handling data subject requests

8. Breach Notification: Process for reporting and managing data breaches

Optional Sections

1. International Transfers: Required when data crosses borders - includes mechanisms and safeguards for international data transfers

2. Sector-Specific Compliance: Additional requirements for regulated industries (HIPAA, GLBA, FERPA, or COPPA compliance)

3. Sub-processing: Rules and requirements for engaging additional processors by either party

Suggested Schedules

1. Schedule 1 - Data Processing Details: Detailed description of data categories, purposes, and processing activities

2. Schedule 2 - Security Measures: Technical and organizational measures implemented by both parties

3. Schedule 3 - Sub-processor List: List of approved sub-processors and their roles

4. Schedule 4 - Data Transfer Mechanisms: Approved methods and safeguards for international data transfers

Authors

Alex Denne

Head of Growth (Open Source Law) @ Genie AI | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

alex.den.21@genieai.co

Relevant legal definitions

Clauses

Relevant Industries

Financial Services
Healthcare
Technology
Retail
Education

Relevant Teams

Legal
Privacy
Information Security
Compliance
IT
Risk Management

Relevant Roles

Chief Privacy Officer
Data Protection Officer
Chief Information Security Officer
Privacy Counsel
Compliance Manager

Industries

FTC Act: Federal Trade Commission Act, particularly Section 5, which governs unfair or deceptive practices and establishes privacy and data security requirements at the federal level

CCPA/CPRA: California Consumer Privacy Act and California Privacy Rights Act - comprehensive state privacy laws that set requirements for businesses handling California residents' data, including specific provisions for data sharing between businesses

VCDPA: Virginia Consumer Data Protection Act - state privacy law establishing requirements for processing Virginia residents' personal data

CPA: Colorado Privacy Act - state privacy law governing the processing of Colorado residents' personal data

UCPA: Utah Consumer Privacy Act - state privacy law establishing requirements for processing Utah residents' personal data

GDPR Considerations: European Union's General Data Protection Regulation requirements, particularly Article 26 for joint controllers and data transfer mechanisms, if processing EU residents' data

HIPAA: Health Insurance Portability and Accountability Act - federal law governing protected health information in the healthcare sector

GLBA: Gramm-Leach-Bliley Act - federal law governing personal financial information in the financial sector

FERPA: Family Educational Rights and Privacy Act - federal law protecting the privacy of student education records

COPPA: Children's Online Privacy Protection Act - federal law governing the collection of personal information from children under 13

NIST Framework: National Institute of Standards and Technology Cybersecurity Framework - voluntary guidance for organizations to better manage and reduce cybersecurity risk

ISO 27001: International standard for information security management systems, providing requirements for establishing, implementing, maintaining and continually improving security controls

SOC 2: Service Organization Control 2 - compliance framework for managing data security based on trust service criteria

State Breach Laws: Various state-specific data breach notification laws requiring notification of affected individuals in case of data breaches

Cross-Border Requirements: Requirements and mechanisms for lawful international data transfers, including standard contractual clauses and adequacy decisions

Find the exact document you need

Subprocessor Agreement

A U.S.-compliant legal agreement governing the relationship between a data processor and subprocessor for personal data processing activities.

How a Sales & Marketing Lead uses Genie AI to reduce contract drafting time by 95%

Let's create your Controller To Controller Dpa

Authors

Alex Denne

Find the exact document you need

Subprocessor Agreement

Controller Processor Contract

Dpa Contract

Dpa Addendum

Data Controller Dpa

Joint Data Controller Agreement

Data Processing Addendum Dpa

Third Party Processor Agreement

Personal Data Collection Agreement

International Data Protection Agreement

Data Sharing Agreement Controller To Processor

Processor To Processor Dpa

Master Data Protection Agreement

Controller To Controller Data Processing Agreement

Intra Group Data Transfer Agreement

Data Management Agreement

Data Controller To Data Controller Agreement

Commissioned Data Processing Agreement

Intercompany Data Processing Agreement

Controller To Controller Dpa

Intercompany Data Sharing Agreement

Dpa Agreement

Data Transfer Addendum

Supplier Data Processing Agreement

Personal Data Transfer Agreement

Controller Processor Agreement

Order Processing Agreement

Data Protection Agreement For Employees

Affiliate Addendum

Data Privacy Addendum

Sub Processing Agreement

International Data Transfer Agreement

Data Protection Addendum

Download our whitepaper on the future of AI in Legal

Genie’s Security Promise

Your documents are private:

Your documents are protected:

Organizational security

Innovation in privacy:

Want to know more?

Draft quality legal agreements or review documents in 3 minutes

Templates

Commercial

Employment

IP

Administration

Finance

R&D

Industries

Legal Services

Manufacturing

Construction

Solutions

Use Cases

Company Types

Comparisons

Business Categories

Teams

Information