1. Parties: Identification of the primary processor (as client) and the sub-processor (as service provider), including their full legal names, registration numbers, and registered addresses
2. Background: Context of the agreement, reference to the main processing agreement, and the need for sub-processing services
3. Definitions: Definitions of key terms used in the agreement, including terms from POPIA such as 'personal information', 'processing', 'operator', and agreement-specific terms
4. Appointment and Scope: Formal appointment of the sub-processor and detailed description of the processing activities to be performed
5. Duration and Termination: Term of the agreement, termination rights and procedures, and consequences of termination
6. Sub-processor Obligations: Core obligations including compliance with POPIA, following instructions, confidentiality, security measures, and data breach reporting
7. Technical and Organizational Measures: Specific security measures and safeguards required for processing activities
8. Audit Rights: Primary processor's rights to audit the sub-processor's compliance and documentation requirements
9. Data Subject Rights: Procedures for handling data subject requests and supporting the primary processor in fulfilling these obligations
10. Breach Notification: Procedures and timeframes for reporting security incidents and data breaches
11. Liability and Indemnity: Allocation of liability and indemnification obligations between the parties
12. General Provisions: Standard contractual clauses including governing law, jurisdiction, entire agreement, and amendment procedures
