Data Processing Agreement (DPA) - AiPro Institute<\/title>\n <style>\n * {\n margin: 0;\n padding: 0;\n box-sizing: border-box;\n }\n \n body {\n font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;\n line-height: 1.6;\n color: #333;\n background: linear-gradient(135deg, #f5f3ff 0%, #e0f2fe 100%);\n padding: 20px;\n }\n \n .container {\n max-width: 900px;\n margin: 0 auto;\n background: white;\n padding: 60px;\n box-shadow: 0 10px 40px rgba(0,0,0,0.1);\n border-radius: 8px;\n }\n \n .header {\n text-align: center;\n margin-bottom: 40px;\n padding-bottom: 30px;\n border-bottom: 4px solid;\n border-image: linear-gradient(90deg, #8B5CF6 0%, #3B82F6 100%) 1;\n }\n \n .brand-title {\n background: linear-gradient(90deg, #8B5CF6 0%, #3B82F6 100%);\n -webkit-background-clip: text;\n -webkit-text-fill-color: transparent;\n background-clip: text;\n font-size: 28px;\n font-weight: bold;\n margin-bottom: 5px;\n }\n \n .doc-title {\n font-size: 32px;\n font-weight: bold;\n color: #1a1a1a;\n margin: 20px 0 10px 0;\n }\n \n .doc-subtitle {\n color: #666;\n font-size: 14px;\n font-style: italic;\n }\n \n .compliance-badge {\n display: inline-block;\n background: linear-gradient(90deg, #8B5CF6 0%, #3B82F6 100%);\n color: white;\n padding: 8px 16px;\n border-radius: 20px;\n font-size: 12px;\n font-weight: bold;\n margin: 5px;\n }\n \n .fill-field {\n background: linear-gradient(135deg, #f3e8ff 0%, #dbeafe 100%);\n padding: 2px 8px;\n border-radius: 4px;\n border: 2px dashed #8B5CF6;\n font-weight: 600;\n color: #8B5CF6;\n display: inline-block;\n min-width: 150px;\n text-align: center;\n }\n \n .section {\n margin: 30px 0;\n }\n \n .section-title {\n font-size: 20px;\n font-weight: bold;\n color: #8B5CF6;\n margin: 25px 0 15px 0;\n padding-bottom: 8px;\n border-bottom: 2px solid #e9d5ff;\n }\n \n .subsection-title {\n font-size: 16px;\n font-weight: bold;\n color: #3B82F6;\n margin: 20px 0 10px 0;\n }\n \n .clause {\n margin: 15px 0;\n padding-left: 20px;\n }\n \n .clause-number {\n font-weight: bold;\n color: #8B5CF6;\n margin-right: 8px;\n }\n \n ul, ol {\n margin: 10px 0 10px 40px;\n }\n \n li {\n margin: 8px 0;\n }\n \n .important-box {\n background: #fef3c7;\n border-left: 4px solid #f59e0b;\n padding: 15px;\n margin: 20px 0;\n border-radius: 4px;\n }\n \n .gdpr-box {\n background: linear-gradient(135deg, #f3e8ff 0%, #dbeafe 100%);\n border: 2px solid #8B5CF6;\n padding: 15px;\n margin: 20px 0;\n border-radius: 8px;\n }\n \n .annex-box {\n background: #f9fafb;\n border: 1px solid #d1d5db;\n padding: 20px;\n margin: 20px 0;\n border-radius: 8px;\n }\n \n .signature-section {\n margin-top: 50px;\n display: grid;\n grid-template-columns: 1fr 1fr;\n gap: 40px;\n }\n \n .signature-block {\n border-top: 2px solid #8B5CF6;\n padding-top: 20px;\n }\n \n .signature-line {\n border-bottom: 2px solid #333;\n min-height: 50px;\n margin: 20px 0 10px 0;\n }\n \n .signature-label {\n font-weight: bold;\n color: #666;\n font-size: 14px;\n margin-top: 5px;\n }\n \n .footer {\n margin-top: 50px;\n padding-top: 20px;\n border-top: 2px solid #e5e7eb;\n text-align: center;\n color: #666;\n font-size: 12px;\n }\n \n .watermark {\n position: fixed;\n bottom: 20px;\n right: 20px;\n opacity: 0.1;\n font-size: 60px;\n font-weight: bold;\n color: #8B5CF6;\n pointer-events: none;\n transform: rotate(-45deg);\n }\n \n @media print {\n body {\n background: white;\n padding: 0;\n }\n .container {\n box-shadow: none;\n padding: 40px;\n }\n .watermark {\n opacity: 0.05;\n }\n }\n \n @media (max-width: 768px) {\n .container {\n padding: 30px 20px;\n }\n .signature-section {\n grid-template-columns: 1fr;\n }\n }\n <\/style>\n<\/head>\n<body>\n <div class=\"watermark\">AIPRO INSTITUTE<\/div>\n \n <div class=\"container\">\n <div class=\"header\">\n <div class=\"brand-title\">AiPro Institute\u2122<\/div>\n <h1 class=\"doc-title\">DATA PROCESSING AGREEMENT<\/h1>\n <p class=\"doc-subtitle\">GDPR & Privacy Compliance Template<\/p>\n <div style=\"margin-top: 15px;\">\n <span class=\"compliance-badge\">GDPR COMPLIANT<\/span>\n <span class=\"compliance-badge\">CCPA READY<\/span>\n <span class=\"compliance-badge\">ISO 27001<\/span>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <p><strong>EFFECTIVE DATE:<\/strong> <span class=\"fill-field\">[DATE]<\/span><\/p>\n <p style=\"margin-top: 15px;\"><strong>BETWEEN:<\/strong><\/p>\n <p style=\"margin-left: 20px;\"><span class=\"fill-field\">[DATA CONTROLLER NAME]<\/span>, a <span class=\"fill-field\">[STATE\/COUNTRY]<\/span> <span class=\"fill-field\">[ENTITY TYPE]<\/span> with its principal place of business at <span class=\"fill-field\">[ADDRESS]<\/span> (hereinafter referred to as \"<strong>Data Controller<\/strong>\" or \"<strong>Controller<\/strong>\")<\/p>\n \n <p style=\"margin-top: 15px;\"><strong>AND:<\/strong><\/p>\n <p style=\"margin-left: 20px;\"><span class=\"fill-field\">[DATA PROCESSOR NAME]<\/span>, a <span class=\"fill-field\">[STATE\/COUNTRY]<\/span> <span class=\"fill-field\">[ENTITY TYPE]<\/span> with its principal place of business at <span class=\"fill-field\">[ADDRESS]<\/span> (hereinafter referred to as \"<strong>Data Processor<\/strong>\" or \"<strong>Processor<\/strong>\")<\/p>\n <\/div>\n\n <div class=\"gdpr-box\">\n <p><strong>\ud83d\udee1\ufe0f PRIVACY REGULATION COMPLIANCE<\/strong><\/p>\n <p style=\"margin-top: 10px;\">This Data Processing Agreement is designed to comply with:<\/p>\n <ul style=\"margin: 10px 0 0 20px;\">\n <li><strong>GDPR<\/strong> - EU General Data Protection Regulation (EU) 2016\/679<\/li>\n <li><strong>UK GDPR<\/strong> - UK Data Protection Act 2018<\/li>\n <li><strong>CCPA<\/strong> - California Consumer Privacy Act<\/li>\n <li><strong>Other applicable data protection laws<\/strong><\/li>\n <\/ul>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">RECITALS<\/h2>\n <p><strong>WHEREAS,<\/strong> Data Controller and Data Processor have entered into an agreement dated <span class=\"fill-field\">[DATE]<\/span> (the \"<strong>Principal Agreement<\/strong>\") pursuant to which Processor provides certain services to Controller;<\/p>\n <p style=\"margin-top: 10px;\"><strong>WHEREAS,<\/strong> in the course of providing such services, Processor may process Personal Data on behalf of Controller;<\/p>\n <p style=\"margin-top: 10px;\"><strong>WHEREAS,<\/strong> the Parties wish to ensure that such processing complies with applicable data protection laws and regulations;<\/p>\n <p style=\"margin-top: 10px;\"><strong>NOW, THEREFORE,<\/strong> the Parties agree as follows:<\/p>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">1. DEFINITIONS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">1.1<\/span>The following terms shall have the meanings set forth below:<\/p>\n <ul>\n <li><strong>\"Affiliate\"<\/strong> means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party.<\/li>\n <li><strong>\"Applicable Data Protection Law\"<\/strong> means all laws and regulations applicable to the processing of Personal Data, including but not limited to GDPR, UK GDPR, CCPA, and equivalent laws.<\/li>\n <li><strong>\"CCPA\"<\/strong> means the California Consumer Privacy Act of 2018, as amended.<\/li>\n <li><strong>\"Data Breach\"<\/strong> means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.<\/li>\n <li><strong>\"Data Controller\" or \"Controller\"<\/strong> means the entity that determines the purposes and means of processing Personal Data.<\/li>\n <li><strong>\"Data Processor\" or \"Processor\"<\/strong> means the entity that processes Personal Data on behalf of the Controller.<\/li>\n <li><strong>\"Data Subject\"<\/strong> means an identified or identifiable natural person whose Personal Data is processed.<\/li>\n <li><strong>\"GDPR\"<\/strong> means the General Data Protection Regulation (EU) 2016\/679.<\/li>\n <li><strong>\"Personal Data\"<\/strong> means any information relating to an identified or identifiable natural person, as defined in Applicable Data Protection Law.<\/li>\n <li><strong>\"Processing\"<\/strong> means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.<\/li>\n <li><strong>\"Special Categories of Personal Data\"<\/strong> means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.<\/li>\n <li><strong>\"Sub-processor\"<\/strong> means any third party appointed by Processor to process Personal Data on behalf of Controller.<\/li>\n <li><strong>\"Supervisory Authority\"<\/strong> means an independent public authority established by an EU Member State to oversee compliance with data protection law.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">2. SCOPE AND NATURE OF PROCESSING<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">2.1<\/span><strong>Subject Matter and Duration.<\/strong> This DPA applies to the processing of Personal Data by Processor on behalf of Controller in connection with the Principal Agreement for the duration of that agreement.<\/p>\n \n <p><span class=\"clause-number\">2.2<\/span><strong>Nature and Purpose of Processing.<\/strong> Processor shall process Personal Data for the following purposes:<\/p>\n <p style=\"margin-left: 20px; margin-top: 10px;\"><span class=\"fill-field\">[DESCRIBE PURPOSE: e.g., customer relationship management, service delivery, technical support, analytics, etc.]<\/span><\/p>\n \n <p><span class=\"clause-number\">2.3<\/span><strong>Types of Personal Data.<\/strong> The processing involves the following categories of Personal Data:<\/p>\n <ul>\n <li>\u2610 Contact information (name, email, phone, address)<\/li>\n <li>\u2610 Identification data (ID numbers, passport, driver's license)<\/li>\n <li>\u2610 Financial data (payment information, bank details)<\/li>\n <li>\u2610 Technical data (IP address, device ID, usage data)<\/li>\n <li>\u2610 Professional data (job title, employer, work history)<\/li>\n <li>\u2610 Authentication data (usernames, passwords, security questions)<\/li>\n <li>\u2610 Communication data (emails, chat logs, support tickets)<\/li>\n <li>\u2610 <span class=\"fill-field\">[OTHER - SPECIFY]<\/span><\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">2.4<\/span><strong>Categories of Data Subjects.<\/strong> The Personal Data relates to the following categories of Data Subjects:<\/p>\n <ul>\n <li>\u2610 Customers\/Clients<\/li>\n <li>\u2610 Employees<\/li>\n <li>\u2610 Contractors<\/li>\n <li>\u2610 Suppliers<\/li>\n <li>\u2610 Website visitors<\/li>\n <li>\u2610 <span class=\"fill-field\">[OTHER - SPECIFY]<\/span><\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">2.5<\/span><strong>Special Categories of Personal Data.<\/strong><\/p>\n <ul>\n <li>\u2610 This processing does NOT involve Special Categories of Personal Data<\/li>\n <li>\u2610 This processing involves the following Special Categories: <span class=\"fill-field\">[SPECIFY]<\/span><\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">3. PROCESSOR'S OBLIGATIONS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">3.1<\/span><strong>Processing Instructions.<\/strong> Processor shall:<\/p>\n <ul>\n <li>Process Personal Data only on documented instructions from Controller, including transfers to third countries, unless required by applicable law;<\/li>\n <li>Immediately inform Controller if, in its opinion, an instruction infringes Applicable Data Protection Law;<\/li>\n <li>Not process Personal Data for any purpose other than as instructed by Controller;<\/li>\n <li>Maintain a record of all categories of processing activities carried out on behalf of Controller.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">3.2<\/span><strong>Confidentiality.<\/strong> Processor shall ensure that persons authorized to process Personal Data:<\/p>\n <ul>\n <li>Have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;<\/li>\n <li>Receive appropriate training on data protection;<\/li>\n <li>Are only granted access to Personal Data to the extent necessary for performing their duties.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">3.3<\/span><strong>Technical and Organizational Measures.<\/strong> Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:<\/p>\n <ul>\n <li>Pseudonymization and encryption of Personal Data where appropriate;<\/li>\n <li>Ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems;<\/li>\n <li>Ability to restore availability and access to Personal Data in a timely manner in the event of incident;<\/li>\n <li>Regular testing, assessment, and evaluation of effectiveness of security measures;<\/li>\n <li>Access controls and authentication mechanisms;<\/li>\n <li>Physical security of facilities where Personal Data is processed;<\/li>\n <li>Measures to protect against unauthorized or unlawful processing, accidental loss, destruction, or damage.<\/li>\n <\/ul>\n <p style=\"margin-left: 20px; font-style: italic; color: #666;\">Specific security measures are detailed in Annex 2.<\/p>\n \n <p><span class=\"clause-number\">3.4<\/span><strong>Assistance to Controller.<\/strong> Processor shall, taking into account the nature of processing, assist Controller by appropriate technical and organizational measures in:<\/p>\n <ul>\n <li>Fulfilling Controller's obligation to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection);<\/li>\n <li>Ensuring compliance with security obligations;<\/li>\n <li>Conducting data protection impact assessments when required;<\/li>\n <li>Consulting with Supervisory Authorities when required.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">3.5<\/span><strong>Data Breach Notification.<\/strong> Processor shall:<\/p>\n <ul>\n <li>Notify Controller without undue delay (and in any event within <span class=\"fill-field\">[24]<\/span> hours) after becoming aware of a Data Breach;<\/li>\n <li>Provide Controller with sufficient information to enable it to comply with any obligations to notify Data Subjects or Supervisory Authorities;<\/li>\n <li>Cooperate with Controller and take reasonable steps to remediate the Data Breach;<\/li>\n <li>Document all Data Breaches and provide records to Controller upon request.<\/li>\n <\/ul>\n <p style=\"margin-left: 20px;\">Notification must include: nature of breach, categories and approximate number of affected Data Subjects and records, likely consequences, measures taken or proposed to address the breach, and contact details for further information.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">4. SUB-PROCESSORS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">4.1<\/span><strong>Authorization.<\/strong><\/p>\n <ul>\n <li>\u2610 <strong>General Authorization:<\/strong> Controller provides general authorization for Processor to engage Sub-processors, subject to the conditions in this Section.<\/li>\n <li>\u2610 <strong>Prior Specific Authorization:<\/strong> Processor must obtain Controller's prior written consent before engaging any Sub-processor.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">4.2<\/span><strong>Current Sub-processors.<\/strong> Processor currently uses the following Sub-processors:<\/p>\n <p style=\"margin-left: 20px; margin-top: 10px;\"><span class=\"fill-field\">[LIST CURRENT SUB-PROCESSORS, SERVICES PROVIDED, LOCATION]<\/span><\/p>\n <ul>\n <li>Example: [Cloud Provider Name] - Cloud hosting services - [Location]<\/li>\n <li>Example: [Email Service] - Email delivery - [Location]<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">4.3<\/span><strong>New Sub-processors.<\/strong> If Processor intends to engage a new Sub-processor:<\/p>\n <ul>\n <li>Processor shall inform Controller at least <span class=\"fill-field\">[30]<\/span> days in advance;<\/li>\n <li>Controller may object on reasonable data protection grounds within <span class=\"fill-field\">[14]<\/span> days;<\/li>\n <li>If Controller objects, Parties shall discuss in good faith to resolve the issue;<\/li>\n <li>If unresolved, Controller may terminate the Principal Agreement with respect to the affected services.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">4.4<\/span><strong>Sub-processor Requirements.<\/strong> Processor shall:<\/p>\n <ul>\n <li>Impose on Sub-processors the same data protection obligations as set out in this DPA;<\/li>\n <li>Ensure Sub-processor agreements are in writing and provide adequate security;<\/li>\n <li>Remain fully liable to Controller for performance of Sub-processor's obligations;<\/li>\n <li>Conduct appropriate due diligence on Sub-processors;<\/li>\n <li>Monitor Sub-processor compliance and conduct regular audits.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">5. INTERNATIONAL DATA TRANSFERS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">5.1<\/span><strong>Transfer Restrictions.<\/strong> Processor shall not transfer Personal Data to a country outside the European Economic Area (EEA) or UK unless:<\/p>\n <ul>\n <li>The transfer is to a country with an adequacy decision from the European Commission or UK;<\/li>\n <li>Appropriate safeguards are in place (Standard Contractual Clauses, Binding Corporate Rules, etc.);<\/li>\n <li>A derogation under Article 49 GDPR applies;<\/li>\n <li>Controller has provided prior written authorization.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">5.2<\/span><strong>Current International Transfers.<\/strong><\/p>\n <p style=\"margin-left: 20px;\">Personal Data will be transferred to the following countries: <span class=\"fill-field\">[LIST COUNTRIES]<\/span><\/p>\n <p style=\"margin-left: 20px;\">Transfer mechanism: <span class=\"fill-field\">[ADEQUACY DECISION \/ STANDARD CONTRACTUAL CLAUSES \/ OTHER]<\/span><\/p>\n \n <p><span class=\"clause-number\">5.3<\/span><strong>Standard Contractual Clauses.<\/strong> If applicable, the Standard Contractual Clauses approved by the European Commission are incorporated by reference and attached as Annex 3.<\/p>\n \n <p><span class=\"clause-number\">5.4<\/span><strong>Government Access Requests.<\/strong> If Processor receives a legally binding request from a government or law enforcement authority for access to Personal Data, Processor shall:<\/p>\n <ul>\n <li>Immediately notify Controller (unless legally prohibited);<\/li>\n <li>Challenge the request if appropriate;<\/li>\n <li>Disclose only the minimum Personal Data required;<\/li>\n <li>Document all requests and responses.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">6. DATA SUBJECT RIGHTS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">6.1<\/span><strong>Data Subject Requests.<\/strong> If Processor receives a request from a Data Subject to exercise their rights under Applicable Data Protection Law (access, rectification, erasure, restriction, portability, objection), Processor shall:<\/p>\n <ul>\n <li>Immediately forward the request to Controller;<\/li>\n <li>Not respond to the request without Controller's prior written authorization;<\/li>\n <li>Provide reasonable assistance to Controller in responding to the request;<\/li>\n <li>Implement Controller's instructions regarding the request.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">6.2<\/span><strong>Assistance Timeline.<\/strong> Processor shall provide assistance within <span class=\"fill-field\">[5]<\/span> business days or such shorter period as may be required to enable Controller to comply with applicable legal deadlines.<\/p>\n \n <p><span class=\"clause-number\">6.3<\/span><strong>Reasonable Costs.<\/strong> Controller shall reimburse Processor for reasonable costs of providing assistance that exceeds Processor's normal obligations under the Principal Agreement.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">7. AUDIT RIGHTS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">7.1<\/span><strong>Controller Audit Rights.<\/strong> Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections.<\/p>\n \n <p><span class=\"clause-number\">7.2<\/span><strong>Audit Process.<\/strong><\/p>\n <ul>\n <li>Controller may conduct audits up to <span class=\"fill-field\">[ONCE PER YEAR]<\/span> or more frequently if required by Supervisory Authority;<\/li>\n <li>Controller shall provide <span class=\"fill-field\">[30]<\/span> days' written notice;<\/li>\n <li>Audits shall be conducted during normal business hours;<\/li>\n <li>Audits shall not unreasonably interfere with Processor's operations;<\/li>\n <li>Controller may use independent third-party auditors bound by confidentiality;<\/li>\n <li>Processor may charge reasonable fees for audits exceeding <span class=\"fill-field\">[2]<\/span> per year.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">7.3<\/span><strong>Certifications and Reports.<\/strong> Processor shall provide Controller with:<\/p>\n <ul>\n <li>Copies of relevant certifications (ISO 27001, SOC 2, etc.)<\/li>\n <li>Third-party audit reports and penetration test results<\/li>\n <li>Security assessment documentation<\/li>\n <li>Evidence of compliance with security obligations<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">8. RETURN OR DELETION OF PERSONAL DATA<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">8.1<\/span><strong>Upon Termination.<\/strong> Upon termination or expiration of the Principal Agreement, Processor shall, at Controller's choice:<\/p>\n <ul>\n <li>Return all Personal Data to Controller in a commonly used electronic format; or<\/li>\n <li>Securely delete or destroy all Personal Data.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">8.2<\/span><strong>Timeline.<\/strong> Processor shall complete return or deletion within <span class=\"fill-field\">[30]<\/span> days of termination, unless a longer period is required by applicable law.<\/p>\n \n <p><span class=\"clause-number\">8.3<\/span><strong>Certification.<\/strong> Processor shall provide written certification that all Personal Data has been returned or securely deleted, including confirmation that:<\/p>\n <ul>\n <li>All copies, including backups, have been deleted;<\/li>\n <li>Deletion methods meet industry standards (e.g., DoD 5220.22-M, NIST 800-88);<\/li>\n <li>Sub-processors have also deleted all Personal Data.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">8.4<\/span><strong>Legal Retention.<\/strong> Processor may retain Personal Data to the extent required by applicable law, provided that:<\/p>\n <ul>\n <li>Such retention is limited to what is legally required;<\/li>\n <li>Processor continues to ensure confidentiality and security;<\/li>\n <li>Controller is informed of the legal requirement and retention period;<\/li>\n <li>Personal Data is deleted once the legal requirement expires.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">9. LIABILITY AND INDEMNIFICATION<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">9.1<\/span><strong>Processor Liability.<\/strong> Processor shall be liable for damages caused by processing where:<\/p>\n <ul>\n <li>It has not complied with obligations specifically directed to processors under Applicable Data Protection Law; or<\/li>\n <li>It has acted outside or contrary to lawful instructions from Controller.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">9.2<\/span><strong>Indemnification.<\/strong> Processor shall indemnify, defend, and hold harmless Controller from all claims, losses, damages, fines, and expenses (including legal fees) arising from:<\/p>\n <ul>\n <li>Processor's breach of this DPA;<\/li>\n <li>Processor's violation of Applicable Data Protection Law;<\/li>\n <li>Data Breaches caused by Processor's failure to implement adequate security;<\/li>\n <li>Processor's unauthorized processing of Personal Data;<\/li>\n <li>Regulatory fines or penalties imposed due to Processor's non-compliance.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">9.3<\/span><strong>Limitation.<\/strong> Nothing in this DPA shall limit either Party's liability for fraud, gross negligence, willful misconduct, death, or personal injury.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">10. TERM AND TERMINATION<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">10.1<\/span><strong>Term.<\/strong> This DPA shall commence on the Effective Date and continue for the duration of the Principal Agreement.<\/p>\n \n <p><span class=\"clause-number\">10.2<\/span><strong>Survival.<\/strong> Sections 3 (security), 6 (Data Subject rights), 7 (audit), 8 (deletion), and 9 (liability) shall survive termination to the extent necessary to fulfill remaining obligations.<\/p>\n \n <p><span class=\"clause-number\">10.3<\/span><strong>Termination for Breach.<\/strong> Controller may terminate this DPA immediately if Processor materially breaches data protection obligations and fails to remedy within <span class=\"fill-field\">[15]<\/span> days of written notice.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">11. GENERAL PROVISIONS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">11.1<\/span><strong>Relationship to Principal Agreement.<\/strong> This DPA is supplemental to and forms part of the Principal Agreement. In case of conflict, this DPA prevails on data protection matters.<\/p>\n \n <p><span class=\"clause-number\">11.2<\/span><strong>Changes in Law.<\/strong> If changes in Applicable Data Protection Law require amendments to this DPA, Parties shall cooperate in good faith to agree on necessary modifications.<\/p>\n \n <p><span class=\"clause-number\">11.3<\/span><strong>Governing Law.<\/strong> This DPA shall be governed by the laws of <span class=\"fill-field\">[STATE\/COUNTRY]<\/span>, to the extent not superseded by Applicable Data Protection Law.<\/p>\n \n <p><span class=\"clause-number\">11.4<\/span><strong>Severability.<\/strong> If any provision is found invalid, the remainder shall remain in full force, and invalid provisions shall be modified to achieve the intended effect.<\/p>\n \n <p><span class=\"clause-number\">11.5<\/span><strong>Order of Precedence.<\/strong> In case of conflict: (1) Standard Contractual Clauses, (2) this DPA, (3) Principal Agreement.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"annex-box\">\n <h3 class=\"subsection-title\">ANNEX 1: DETAILS OF PROCESSING<\/h3>\n <p><strong>A. List of Parties<\/strong><\/p>\n <p>Data Controller: <span class=\"fill-field\">[CONTROLLER DETAILS]<\/span><\/p>\n <p>Data Processor: <span class=\"fill-field\">[PROCESSOR DETAILS]<\/span><\/p>\n \n <p style=\"margin-top: 15px;\"><strong>B. Description of Processing<\/strong><\/p>\n <p>Subject matter: <span class=\"fill-field\">[DESCRIBE]<\/span><\/p>\n <p>Duration: <span class=\"fill-field\">[SPECIFY]<\/span><\/p>\n <p>Nature and purpose: As specified in Section 2.2<\/p>\n <p>Type of Personal Data: As specified in Section 2.3<\/p>\n <p>Categories of Data Subjects: As specified in Section 2.4<\/p>\n <\/div>\n\n <div class=\"annex-box\">\n <h3 class=\"subsection-title\">ANNEX 2: TECHNICAL AND ORGANIZATIONAL MEASURES<\/h3>\n <p>Processor implements the following security measures:<\/p>\n <ul>\n <li><strong>Physical Security:<\/strong> <span class=\"fill-field\">[DESCRIBE: access controls, surveillance, secure facilities]<\/span><\/li>\n <li><strong>Access Controls:<\/strong> <span class=\"fill-field\">[DESCRIBE: role-based access, authentication, authorization]<\/span><\/li>\n <li><strong>Encryption:<\/strong> <span class=\"fill-field\">[DESCRIBE: data at rest, data in transit, encryption standards]<\/span><\/li>\n <li><strong>Network Security:<\/strong> <span class=\"fill-field\">[DESCRIBE: firewalls, intrusion detection, VPN]<\/span><\/li>\n <li><strong>Backup and Recovery:<\/strong> <span class=\"fill-field\">[DESCRIBE: backup frequency, retention, disaster recovery]<\/span><\/li>\n <li><strong>Incident Response:<\/strong> <span class=\"fill-field\">[DESCRIBE: incident detection, response procedures, logging]<\/span><\/li>\n <li><strong>Personnel Security:<\/strong> <span class=\"fill-field\">[DESCRIBE: background checks, training, confidentiality agreements]<\/span><\/li>\n <li><strong>Vendor Management:<\/strong> <span class=\"fill-field\">[DESCRIBE: Sub-processor oversight, due diligence]<\/span><\/li>\n <\/ul>\n <\/div>\n\n <div class=\"annex-box\">\n <h3 class=\"subsection-title\">ANNEX 3: SUB-PROCESSORS<\/h3>\n <table style=\"width: 100%; border-collapse: collapse;\">\n <thead>\n <tr style=\"background: #f3f4f6;\">\n <th style=\"border: 1px solid #d1d5db; padding: 8px; text-align: left;\">Sub-processor<\/th>\n <th style=\"border: 1px solid #d1d5db; padding: 8px; text-align: left;\">Services<\/th>\n <th style=\"border: 1px solid #d1d5db; padding: 8px; text-align: left;\">Location<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td style=\"border: 1px solid #d1d5db; padding: 8px;\"><span class=\"fill-field\">[NAME]<\/span><\/td>\n <td style=\"border: 1px solid #d1d5db; padding: 8px;\"><span class=\"fill-field\">[SERVICES]<\/span><\/td>\n <td style=\"border: 1px solid #d1d5db; padding: 8px;\"><span class=\"fill-field\">[LOCATION]<\/span><\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n\n <div class=\"important-box\">\n <p><strong>\u26a0\ufe0f LEGAL NOTICE:<\/strong><\/p>\n <p style=\"margin-top: 10px;\">This Data Processing Agreement must be reviewed by legal counsel specializing in data protection law. Requirements may vary by jurisdiction, industry, and specific circumstances. This template is designed for GDPR compliance but should be adapted for other regulations (CCPA, LGPD, etc.) as applicable.<\/p>\n <\/div>\n\n <div class=\"signature-section\">\n <div class=\"signature-block\">\n <h3 class=\"subsection-title\">DATA CONTROLLER<\/h3>\n <p style=\"margin-bottom: 10px;\"><span class=\"fill-field\">[COMPANY NAME]<\/span><\/p>\n <div class=\"signature-line\"><\/div>\n <p class=\"signature-label\">Authorized Signature<\/p>\n <p style=\"margin-top: 15px;\"><strong>Name:<\/strong> <span class=\"fill-field\">[NAME]<\/span><\/p>\n <p><strong>Title:<\/strong> <span class=\"fill-field\">[TITLE]<\/span><\/p>\n <p><strong>Date:<\/strong> <span class=\"fill-field\">[DATE]<\/span><\/p>\n <\/div>\n \n <div class=\"signature-block\">\n <h3 class=\"subsection-title\">DATA PROCESSOR<\/h3>\n <p style=\"margin-bottom: 10px;\"><span class=\"fill-field\">[COMPANY NAME]<\/span><\/p>\n <div class=\"signature-line\"><\/div>\n <p class=\"signature-label\">Authorized Signature<\/p>\n <p style=\"margin-top: 15px;\"><strong>Name:<\/strong> <span class=\"fill-field\">[NAME]<\/span><\/p>\n <p><strong>Title:<\/strong> <span class=\"fill-field\">[TITLE]<\/span><\/p>\n <p><strong>Date:<\/strong> <span class=\"fill-field\">[DATE]<\/span><\/p>\n <\/div>\n <\/div>\n\n <div class=\"footer\">\n <p><strong>AiPro Institute\u2122 - Professional Business Templates<\/strong><\/p>\n <p style=\"margin-top: 5px;\">This template is provided for informational purposes only and does not constitute legal advice. Consult with a qualified data protection attorney before using this agreement.<\/p>\n <p style=\"margin-top: 10px;\">\u00a9 2026 AiPro Institute. All Rights Reserved. | Member-Only Content<\/p>\n <\/div>\n <\/div>\n<\/body>\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Data Processing Agreement (DPA) – AiPro Institute AIPRO INSTITUTE AiPro Institute\u2122 DATA PROCESSING AGREEMENT GDPR & Privacy Compliance Template GDPR COMPLIANT CCPA READY ISO 27001 EFFECTIVE DATE: [DATE] BETWEEN: [DATA CONTROLLER NAME], a [STATE\/COUNTRY] [ENTITY TYPE] with its principal place of business at [ADDRESS] (hereinafter referred to as “Data Controller” or “Controller“) AND: [DATA PROCESSOR…<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[77],"tags":[],"class_list":["post-2543","post","type-post","status-publish","format-standard","hentry","category-legal-contracts-department"],"acf":[],"_links":{"self":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/2543","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/comments?post=2543"}],"version-history":[{"count":4,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/2543\/revisions"}],"predecessor-version":[{"id":2551,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/2543\/revisions\/2551"}],"wp:attachment":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/media?parent=2543"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/categories?post=2543"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/tags?post=2543"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

\n\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t

\n\t\t\t\t\t\t

\n\t\t\t\t\t\n\n\n \n \n Data Processing Agreement (DPA) - AiPro Institute<\/title>\n <style>\n * {\n margin: 0;\n padding: 0;\n box-sizing: border-box;\n }\n \n body {\n font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;\n line-height: 1.6;\n color: #333;\n background: linear-gradient(135deg, #f5f3ff 0%, #e0f2fe 100%);\n padding: 20px;\n }\n \n .container {\n max-width: 900px;\n margin: 0 auto;\n background: white;\n padding: 60px;\n box-shadow: 0 10px 40px rgba(0,0,0,0.1);\n border-radius: 8px;\n }\n \n .header {\n text-align: center;\n margin-bottom: 40px;\n padding-bottom: 30px;\n border-bottom: 4px solid;\n border-image: linear-gradient(90deg, #8B5CF6 0%, #3B82F6 100%) 1;\n }\n \n .brand-title {\n background: linear-gradient(90deg, #8B5CF6 0%, #3B82F6 100%);\n -webkit-background-clip: text;\n -webkit-text-fill-color: transparent;\n background-clip: text;\n font-size: 28px;\n font-weight: bold;\n margin-bottom: 5px;\n }\n \n .doc-title {\n font-size: 32px;\n font-weight: bold;\n color: #1a1a1a;\n margin: 20px 0 10px 0;\n }\n \n .doc-subtitle {\n color: #666;\n font-size: 14px;\n font-style: italic;\n }\n \n .compliance-badge {\n display: inline-block;\n background: linear-gradient(90deg, #8B5CF6 0%, #3B82F6 100%);\n color: white;\n padding: 8px 16px;\n border-radius: 20px;\n font-size: 12px;\n font-weight: bold;\n margin: 5px;\n }\n \n .fill-field {\n background: linear-gradient(135deg, #f3e8ff 0%, #dbeafe 100%);\n padding: 2px 8px;\n border-radius: 4px;\n border: 2px dashed #8B5CF6;\n font-weight: 600;\n color: #8B5CF6;\n display: inline-block;\n min-width: 150px;\n text-align: center;\n }\n \n .section {\n margin: 30px 0;\n }\n \n .section-title {\n font-size: 20px;\n font-weight: bold;\n color: #8B5CF6;\n margin: 25px 0 15px 0;\n padding-bottom: 8px;\n border-bottom: 2px solid #e9d5ff;\n }\n \n .subsection-title {\n font-size: 16px;\n font-weight: bold;\n color: #3B82F6;\n margin: 20px 0 10px 0;\n }\n \n .clause {\n margin: 15px 0;\n padding-left: 20px;\n }\n \n .clause-number {\n font-weight: bold;\n color: #8B5CF6;\n margin-right: 8px;\n }\n \n ul, ol {\n margin: 10px 0 10px 40px;\n }\n \n li {\n margin: 8px 0;\n }\n \n .important-box {\n background: #fef3c7;\n border-left: 4px solid #f59e0b;\n padding: 15px;\n margin: 20px 0;\n border-radius: 4px;\n }\n \n .gdpr-box {\n background: linear-gradient(135deg, #f3e8ff 0%, #dbeafe 100%);\n border: 2px solid #8B5CF6;\n padding: 15px;\n margin: 20px 0;\n border-radius: 8px;\n }\n \n .annex-box {\n background: #f9fafb;\n border: 1px solid #d1d5db;\n padding: 20px;\n margin: 20px 0;\n border-radius: 8px;\n }\n \n .signature-section {\n margin-top: 50px;\n display: grid;\n grid-template-columns: 1fr 1fr;\n gap: 40px;\n }\n \n .signature-block {\n border-top: 2px solid #8B5CF6;\n padding-top: 20px;\n }\n \n .signature-line {\n border-bottom: 2px solid #333;\n min-height: 50px;\n margin: 20px 0 10px 0;\n }\n \n .signature-label {\n font-weight: bold;\n color: #666;\n font-size: 14px;\n margin-top: 5px;\n }\n \n .footer {\n margin-top: 50px;\n padding-top: 20px;\n border-top: 2px solid #e5e7eb;\n text-align: center;\n color: #666;\n font-size: 12px;\n }\n \n .watermark {\n position: fixed;\n bottom: 20px;\n right: 20px;\n opacity: 0.1;\n font-size: 60px;\n font-weight: bold;\n color: #8B5CF6;\n pointer-events: none;\n transform: rotate(-45deg);\n }\n \n @media print {\n body {\n background: white;\n padding: 0;\n }\n .container {\n box-shadow: none;\n padding: 40px;\n }\n .watermark {\n opacity: 0.05;\n }\n }\n \n @media (max-width: 768px) {\n .container {\n padding: 30px 20px;\n }\n .signature-section {\n grid-template-columns: 1fr;\n }\n }\n <\/style>\n<\/head>\n<body>\n <div class=\"watermark\">AIPRO INSTITUTE<\/div>\n \n <div class=\"container\">\n <div class=\"header\">\n <div class=\"brand-title\">AiPro Institute\u2122<\/div>\n <h1 class=\"doc-title\">DATA PROCESSING AGREEMENT<\/h1>\n <p class=\"doc-subtitle\">GDPR & Privacy Compliance Template<\/p>\n <div style=\"margin-top: 15px;\">\n <span class=\"compliance-badge\">GDPR COMPLIANT<\/span>\n <span class=\"compliance-badge\">CCPA READY<\/span>\n <span class=\"compliance-badge\">ISO 27001<\/span>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <p><strong>EFFECTIVE DATE:<\/strong> <span class=\"fill-field\">[DATE]<\/span><\/p>\n <p style=\"margin-top: 15px;\"><strong>BETWEEN:<\/strong><\/p>\n <p style=\"margin-left: 20px;\"><span class=\"fill-field\">[DATA CONTROLLER NAME]<\/span>, a <span class=\"fill-field\">[STATE\/COUNTRY]<\/span> <span class=\"fill-field\">[ENTITY TYPE]<\/span> with its principal place of business at <span class=\"fill-field\">[ADDRESS]<\/span> (hereinafter referred to as \"<strong>Data Controller<\/strong>\" or \"<strong>Controller<\/strong>\")<\/p>\n \n <p style=\"margin-top: 15px;\"><strong>AND:<\/strong><\/p>\n <p style=\"margin-left: 20px;\"><span class=\"fill-field\">[DATA PROCESSOR NAME]<\/span>, a <span class=\"fill-field\">[STATE\/COUNTRY]<\/span> <span class=\"fill-field\">[ENTITY TYPE]<\/span> with its principal place of business at <span class=\"fill-field\">[ADDRESS]<\/span> (hereinafter referred to as \"<strong>Data Processor<\/strong>\" or \"<strong>Processor<\/strong>\")<\/p>\n <\/div>\n\n <div class=\"gdpr-box\">\n <p><strong>\ud83d\udee1\ufe0f PRIVACY REGULATION COMPLIANCE<\/strong><\/p>\n <p style=\"margin-top: 10px;\">This Data Processing Agreement is designed to comply with:<\/p>\n <ul style=\"margin: 10px 0 0 20px;\">\n <li><strong>GDPR<\/strong> - EU General Data Protection Regulation (EU) 2016\/679<\/li>\n <li><strong>UK GDPR<\/strong> - UK Data Protection Act 2018<\/li>\n <li><strong>CCPA<\/strong> - California Consumer Privacy Act<\/li>\n <li><strong>Other applicable data protection laws<\/strong><\/li>\n <\/ul>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">RECITALS<\/h2>\n <p><strong>WHEREAS,<\/strong> Data Controller and Data Processor have entered into an agreement dated <span class=\"fill-field\">[DATE]<\/span> (the \"<strong>Principal Agreement<\/strong>\") pursuant to which Processor provides certain services to Controller;<\/p>\n <p style=\"margin-top: 10px;\"><strong>WHEREAS,<\/strong> in the course of providing such services, Processor may process Personal Data on behalf of Controller;<\/p>\n <p style=\"margin-top: 10px;\"><strong>WHEREAS,<\/strong> the Parties wish to ensure that such processing complies with applicable data protection laws and regulations;<\/p>\n <p style=\"margin-top: 10px;\"><strong>NOW, THEREFORE,<\/strong> the Parties agree as follows:<\/p>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">1. DEFINITIONS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">1.1<\/span>The following terms shall have the meanings set forth below:<\/p>\n <ul>\n <li><strong>\"Affiliate\"<\/strong> means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party.<\/li>\n <li><strong>\"Applicable Data Protection Law\"<\/strong> means all laws and regulations applicable to the processing of Personal Data, including but not limited to GDPR, UK GDPR, CCPA, and equivalent laws.<\/li>\n <li><strong>\"CCPA\"<\/strong> means the California Consumer Privacy Act of 2018, as amended.<\/li>\n <li><strong>\"Data Breach\"<\/strong> means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.<\/li>\n <li><strong>\"Data Controller\" or \"Controller\"<\/strong> means the entity that determines the purposes and means of processing Personal Data.<\/li>\n <li><strong>\"Data Processor\" or \"Processor\"<\/strong> means the entity that processes Personal Data on behalf of the Controller.<\/li>\n <li><strong>\"Data Subject\"<\/strong> means an identified or identifiable natural person whose Personal Data is processed.<\/li>\n <li><strong>\"GDPR\"<\/strong> means the General Data Protection Regulation (EU) 2016\/679.<\/li>\n <li><strong>\"Personal Data\"<\/strong> means any information relating to an identified or identifiable natural person, as defined in Applicable Data Protection Law.<\/li>\n <li><strong>\"Processing\"<\/strong> means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.<\/li>\n <li><strong>\"Special Categories of Personal Data\"<\/strong> means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.<\/li>\n <li><strong>\"Sub-processor\"<\/strong> means any third party appointed by Processor to process Personal Data on behalf of Controller.<\/li>\n <li><strong>\"Supervisory Authority\"<\/strong> means an independent public authority established by an EU Member State to oversee compliance with data protection law.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">2. SCOPE AND NATURE OF PROCESSING<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">2.1<\/span><strong>Subject Matter and Duration.<\/strong> This DPA applies to the processing of Personal Data by Processor on behalf of Controller in connection with the Principal Agreement for the duration of that agreement.<\/p>\n \n <p><span class=\"clause-number\">2.2<\/span><strong>Nature and Purpose of Processing.<\/strong> Processor shall process Personal Data for the following purposes:<\/p>\n <p style=\"margin-left: 20px; margin-top: 10px;\"><span class=\"fill-field\">[DESCRIBE PURPOSE: e.g., customer relationship management, service delivery, technical support, analytics, etc.]<\/span><\/p>\n \n <p><span class=\"clause-number\">2.3<\/span><strong>Types of Personal Data.<\/strong> The processing involves the following categories of Personal Data:<\/p>\n <ul>\n <li>\u2610 Contact information (name, email, phone, address)<\/li>\n <li>\u2610 Identification data (ID numbers, passport, driver's license)<\/li>\n <li>\u2610 Financial data (payment information, bank details)<\/li>\n <li>\u2610 Technical data (IP address, device ID, usage data)<\/li>\n <li>\u2610 Professional data (job title, employer, work history)<\/li>\n <li>\u2610 Authentication data (usernames, passwords, security questions)<\/li>\n <li>\u2610 Communication data (emails, chat logs, support tickets)<\/li>\n <li>\u2610 <span class=\"fill-field\">[OTHER - SPECIFY]<\/span><\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">2.4<\/span><strong>Categories of Data Subjects.<\/strong> The Personal Data relates to the following categories of Data Subjects:<\/p>\n <ul>\n <li>\u2610 Customers\/Clients<\/li>\n <li>\u2610 Employees<\/li>\n <li>\u2610 Contractors<\/li>\n <li>\u2610 Suppliers<\/li>\n <li>\u2610 Website visitors<\/li>\n <li>\u2610 <span class=\"fill-field\">[OTHER - SPECIFY]<\/span><\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">2.5<\/span><strong>Special Categories of Personal Data.<\/strong><\/p>\n <ul>\n <li>\u2610 This processing does NOT involve Special Categories of Personal Data<\/li>\n <li>\u2610 This processing involves the following Special Categories: <span class=\"fill-field\">[SPECIFY]<\/span><\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">3. PROCESSOR'S OBLIGATIONS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">3.1<\/span><strong>Processing Instructions.<\/strong> Processor shall:<\/p>\n <ul>\n <li>Process Personal Data only on documented instructions from Controller, including transfers to third countries, unless required by applicable law;<\/li>\n <li>Immediately inform Controller if, in its opinion, an instruction infringes Applicable Data Protection Law;<\/li>\n <li>Not process Personal Data for any purpose other than as instructed by Controller;<\/li>\n <li>Maintain a record of all categories of processing activities carried out on behalf of Controller.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">3.2<\/span><strong>Confidentiality.<\/strong> Processor shall ensure that persons authorized to process Personal Data:<\/p>\n <ul>\n <li>Have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;<\/li>\n <li>Receive appropriate training on data protection;<\/li>\n <li>Are only granted access to Personal Data to the extent necessary for performing their duties.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">3.3<\/span><strong>Technical and Organizational Measures.<\/strong> Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:<\/p>\n <ul>\n <li>Pseudonymization and encryption of Personal Data where appropriate;<\/li>\n <li>Ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems;<\/li>\n <li>Ability to restore availability and access to Personal Data in a timely manner in the event of incident;<\/li>\n <li>Regular testing, assessment, and evaluation of effectiveness of security measures;<\/li>\n <li>Access controls and authentication mechanisms;<\/li>\n <li>Physical security of facilities where Personal Data is processed;<\/li>\n <li>Measures to protect against unauthorized or unlawful processing, accidental loss, destruction, or damage.<\/li>\n <\/ul>\n <p style=\"margin-left: 20px; font-style: italic; color: #666;\">Specific security measures are detailed in Annex 2.<\/p>\n \n <p><span class=\"clause-number\">3.4<\/span><strong>Assistance to Controller.<\/strong> Processor shall, taking into account the nature of processing, assist Controller by appropriate technical and organizational measures in:<\/p>\n <ul>\n <li>Fulfilling Controller's obligation to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection);<\/li>\n <li>Ensuring compliance with security obligations;<\/li>\n <li>Conducting data protection impact assessments when required;<\/li>\n <li>Consulting with Supervisory Authorities when required.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">3.5<\/span><strong>Data Breach Notification.<\/strong> Processor shall:<\/p>\n <ul>\n <li>Notify Controller without undue delay (and in any event within <span class=\"fill-field\">[24]<\/span> hours) after becoming aware of a Data Breach;<\/li>\n <li>Provide Controller with sufficient information to enable it to comply with any obligations to notify Data Subjects or Supervisory Authorities;<\/li>\n <li>Cooperate with Controller and take reasonable steps to remediate the Data Breach;<\/li>\n <li>Document all Data Breaches and provide records to Controller upon request.<\/li>\n <\/ul>\n <p style=\"margin-left: 20px;\">Notification must include: nature of breach, categories and approximate number of affected Data Subjects and records, likely consequences, measures taken or proposed to address the breach, and contact details for further information.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">4. SUB-PROCESSORS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">4.1<\/span><strong>Authorization.<\/strong><\/p>\n <ul>\n <li>\u2610 <strong>General Authorization:<\/strong> Controller provides general authorization for Processor to engage Sub-processors, subject to the conditions in this Section.<\/li>\n <li>\u2610 <strong>Prior Specific Authorization:<\/strong> Processor must obtain Controller's prior written consent before engaging any Sub-processor.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">4.2<\/span><strong>Current Sub-processors.<\/strong> Processor currently uses the following Sub-processors:<\/p>\n <p style=\"margin-left: 20px; margin-top: 10px;\"><span class=\"fill-field\">[LIST CURRENT SUB-PROCESSORS, SERVICES PROVIDED, LOCATION]<\/span><\/p>\n <ul>\n <li>Example: [Cloud Provider Name] - Cloud hosting services - [Location]<\/li>\n <li>Example: [Email Service] - Email delivery - [Location]<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">4.3<\/span><strong>New Sub-processors.<\/strong> If Processor intends to engage a new Sub-processor:<\/p>\n <ul>\n <li>Processor shall inform Controller at least <span class=\"fill-field\">[30]<\/span> days in advance;<\/li>\n <li>Controller may object on reasonable data protection grounds within <span class=\"fill-field\">[14]<\/span> days;<\/li>\n <li>If Controller objects, Parties shall discuss in good faith to resolve the issue;<\/li>\n <li>If unresolved, Controller may terminate the Principal Agreement with respect to the affected services.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">4.4<\/span><strong>Sub-processor Requirements.<\/strong> Processor shall:<\/p>\n <ul>\n <li>Impose on Sub-processors the same data protection obligations as set out in this DPA;<\/li>\n <li>Ensure Sub-processor agreements are in writing and provide adequate security;<\/li>\n <li>Remain fully liable to Controller for performance of Sub-processor's obligations;<\/li>\n <li>Conduct appropriate due diligence on Sub-processors;<\/li>\n <li>Monitor Sub-processor compliance and conduct regular audits.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">5. INTERNATIONAL DATA TRANSFERS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">5.1<\/span><strong>Transfer Restrictions.<\/strong> Processor shall not transfer Personal Data to a country outside the European Economic Area (EEA) or UK unless:<\/p>\n <ul>\n <li>The transfer is to a country with an adequacy decision from the European Commission or UK;<\/li>\n <li>Appropriate safeguards are in place (Standard Contractual Clauses, Binding Corporate Rules, etc.);<\/li>\n <li>A derogation under Article 49 GDPR applies;<\/li>\n <li>Controller has provided prior written authorization.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">5.2<\/span><strong>Current International Transfers.<\/strong><\/p>\n <p style=\"margin-left: 20px;\">Personal Data will be transferred to the following countries: <span class=\"fill-field\">[LIST COUNTRIES]<\/span><\/p>\n <p style=\"margin-left: 20px;\">Transfer mechanism: <span class=\"fill-field\">[ADEQUACY DECISION \/ STANDARD CONTRACTUAL CLAUSES \/ OTHER]<\/span><\/p>\n \n <p><span class=\"clause-number\">5.3<\/span><strong>Standard Contractual Clauses.<\/strong> If applicable, the Standard Contractual Clauses approved by the European Commission are incorporated by reference and attached as Annex 3.<\/p>\n \n <p><span class=\"clause-number\">5.4<\/span><strong>Government Access Requests.<\/strong> If Processor receives a legally binding request from a government or law enforcement authority for access to Personal Data, Processor shall:<\/p>\n <ul>\n <li>Immediately notify Controller (unless legally prohibited);<\/li>\n <li>Challenge the request if appropriate;<\/li>\n <li>Disclose only the minimum Personal Data required;<\/li>\n <li>Document all requests and responses.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">6. DATA SUBJECT RIGHTS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">6.1<\/span><strong>Data Subject Requests.<\/strong> If Processor receives a request from a Data Subject to exercise their rights under Applicable Data Protection Law (access, rectification, erasure, restriction, portability, objection), Processor shall:<\/p>\n <ul>\n <li>Immediately forward the request to Controller;<\/li>\n <li>Not respond to the request without Controller's prior written authorization;<\/li>\n <li>Provide reasonable assistance to Controller in responding to the request;<\/li>\n <li>Implement Controller's instructions regarding the request.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">6.2<\/span><strong>Assistance Timeline.<\/strong> Processor shall provide assistance within <span class=\"fill-field\">[5]<\/span> business days or such shorter period as may be required to enable Controller to comply with applicable legal deadlines.<\/p>\n \n <p><span class=\"clause-number\">6.3<\/span><strong>Reasonable Costs.<\/strong> Controller shall reimburse Processor for reasonable costs of providing assistance that exceeds Processor's normal obligations under the Principal Agreement.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">7. AUDIT RIGHTS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">7.1<\/span><strong>Controller Audit Rights.<\/strong> Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections.<\/p>\n \n <p><span class=\"clause-number\">7.2<\/span><strong>Audit Process.<\/strong><\/p>\n <ul>\n <li>Controller may conduct audits up to <span class=\"fill-field\">[ONCE PER YEAR]<\/span> or more frequently if required by Supervisory Authority;<\/li>\n <li>Controller shall provide <span class=\"fill-field\">[30]<\/span> days' written notice;<\/li>\n <li>Audits shall be conducted during normal business hours;<\/li>\n <li>Audits shall not unreasonably interfere with Processor's operations;<\/li>\n <li>Controller may use independent third-party auditors bound by confidentiality;<\/li>\n <li>Processor may charge reasonable fees for audits exceeding <span class=\"fill-field\">[2]<\/span> per year.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">7.3<\/span><strong>Certifications and Reports.<\/strong> Processor shall provide Controller with:<\/p>\n <ul>\n <li>Copies of relevant certifications (ISO 27001, SOC 2, etc.)<\/li>\n <li>Third-party audit reports and penetration test results<\/li>\n <li>Security assessment documentation<\/li>\n <li>Evidence of compliance with security obligations<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">8. RETURN OR DELETION OF PERSONAL DATA<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">8.1<\/span><strong>Upon Termination.<\/strong> Upon termination or expiration of the Principal Agreement, Processor shall, at Controller's choice:<\/p>\n <ul>\n <li>Return all Personal Data to Controller in a commonly used electronic format; or<\/li>\n <li>Securely delete or destroy all Personal Data.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">8.2<\/span><strong>Timeline.<\/strong> Processor shall complete return or deletion within <span class=\"fill-field\">[30]<\/span> days of termination, unless a longer period is required by applicable law.<\/p>\n \n <p><span class=\"clause-number\">8.3<\/span><strong>Certification.<\/strong> Processor shall provide written certification that all Personal Data has been returned or securely deleted, including confirmation that:<\/p>\n <ul>\n <li>All copies, including backups, have been deleted;<\/li>\n <li>Deletion methods meet industry standards (e.g., DoD 5220.22-M, NIST 800-88);<\/li>\n <li>Sub-processors have also deleted all Personal Data.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">8.4<\/span><strong>Legal Retention.<\/strong> Processor may retain Personal Data to the extent required by applicable law, provided that:<\/p>\n <ul>\n <li>Such retention is limited to what is legally required;<\/li>\n <li>Processor continues to ensure confidentiality and security;<\/li>\n <li>Controller is informed of the legal requirement and retention period;<\/li>\n <li>Personal Data is deleted once the legal requirement expires.<\/li>\n <\/ul>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">9. LIABILITY AND INDEMNIFICATION<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">9.1<\/span><strong>Processor Liability.<\/strong> Processor shall be liable for damages caused by processing where:<\/p>\n <ul>\n <li>It has not complied with obligations specifically directed to processors under Applicable Data Protection Law; or<\/li>\n <li>It has acted outside or contrary to lawful instructions from Controller.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">9.2<\/span><strong>Indemnification.<\/strong> Processor shall indemnify, defend, and hold harmless Controller from all claims, losses, damages, fines, and expenses (including legal fees) arising from:<\/p>\n <ul>\n <li>Processor's breach of this DPA;<\/li>\n <li>Processor's violation of Applicable Data Protection Law;<\/li>\n <li>Data Breaches caused by Processor's failure to implement adequate security;<\/li>\n <li>Processor's unauthorized processing of Personal Data;<\/li>\n <li>Regulatory fines or penalties imposed due to Processor's non-compliance.<\/li>\n <\/ul>\n \n <p><span class=\"clause-number\">9.3<\/span><strong>Limitation.<\/strong> Nothing in this DPA shall limit either Party's liability for fraud, gross negligence, willful misconduct, death, or personal injury.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">10. TERM AND TERMINATION<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">10.1<\/span><strong>Term.<\/strong> This DPA shall commence on the Effective Date and continue for the duration of the Principal Agreement.<\/p>\n \n <p><span class=\"clause-number\">10.2<\/span><strong>Survival.<\/strong> Sections 3 (security), 6 (Data Subject rights), 7 (audit), 8 (deletion), and 9 (liability) shall survive termination to the extent necessary to fulfill remaining obligations.<\/p>\n \n <p><span class=\"clause-number\">10.3<\/span><strong>Termination for Breach.<\/strong> Controller may terminate this DPA immediately if Processor materially breaches data protection obligations and fails to remedy within <span class=\"fill-field\">[15]<\/span> days of written notice.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"section\">\n <h2 class=\"section-title\">11. GENERAL PROVISIONS<\/h2>\n <div class=\"clause\">\n <p><span class=\"clause-number\">11.1<\/span><strong>Relationship to Principal Agreement.<\/strong> This DPA is supplemental to and forms part of the Principal Agreement. In case of conflict, this DPA prevails on data protection matters.<\/p>\n \n <p><span class=\"clause-number\">11.2<\/span><strong>Changes in Law.<\/strong> If changes in Applicable Data Protection Law require amendments to this DPA, Parties shall cooperate in good faith to agree on necessary modifications.<\/p>\n \n <p><span class=\"clause-number\">11.3<\/span><strong>Governing Law.<\/strong> This DPA shall be governed by the laws of <span class=\"fill-field\">[STATE\/COUNTRY]<\/span>, to the extent not superseded by Applicable Data Protection Law.<\/p>\n \n <p><span class=\"clause-number\">11.4<\/span><strong>Severability.<\/strong> If any provision is found invalid, the remainder shall remain in full force, and invalid provisions shall be modified to achieve the intended effect.<\/p>\n \n <p><span class=\"clause-number\">11.5<\/span><strong>Order of Precedence.<\/strong> In case of conflict: (1) Standard Contractual Clauses, (2) this DPA, (3) Principal Agreement.<\/p>\n <\/div>\n <\/div>\n\n <div class=\"annex-box\">\n <h3 class=\"subsection-title\">ANNEX 1: DETAILS OF PROCESSING<\/h3>\n <p><strong>A. List of Parties<\/strong><\/p>\n <p>Data Controller: <span class=\"fill-field\">[CONTROLLER DETAILS]<\/span><\/p>\n <p>Data Processor: <span class=\"fill-field\">[PROCESSOR DETAILS]<\/span><\/p>\n \n <p style=\"margin-top: 15px;\"><strong>B. Description of Processing<\/strong><\/p>\n <p>Subject matter: <span class=\"fill-field\">[DESCRIBE]<\/span><\/p>\n <p>Duration: <span class=\"fill-field\">[SPECIFY]<\/span><\/p>\n <p>Nature and purpose: As specified in Section 2.2<\/p>\n <p>Type of Personal Data: As specified in Section 2.3<\/p>\n <p>Categories of Data Subjects: As specified in Section 2.4<\/p>\n <\/div>\n\n <div class=\"annex-box\">\n <h3 class=\"subsection-title\">ANNEX 2: TECHNICAL AND ORGANIZATIONAL MEASURES<\/h3>\n <p>Processor implements the following security measures:<\/p>\n <ul>\n <li><strong>Physical Security:<\/strong> <span class=\"fill-field\">[DESCRIBE: access controls, surveillance, secure facilities]<\/span><\/li>\n <li><strong>Access Controls:<\/strong> <span class=\"fill-field\">[DESCRIBE: role-based access, authentication, authorization]<\/span><\/li>\n <li><strong>Encryption:<\/strong> <span class=\"fill-field\">[DESCRIBE: data at rest, data in transit, encryption standards]<\/span><\/li>\n <li><strong>Network Security:<\/strong> <span class=\"fill-field\">[DESCRIBE: firewalls, intrusion detection, VPN]<\/span><\/li>\n <li><strong>Backup and Recovery:<\/strong> <span class=\"fill-field\">[DESCRIBE: backup frequency, retention, disaster recovery]<\/span><\/li>\n <li><strong>Incident Response:<\/strong> <span class=\"fill-field\">[DESCRIBE: incident detection, response procedures, logging]<\/span><\/li>\n <li><strong>Personnel Security:<\/strong> <span class=\"fill-field\">[DESCRIBE: background checks, training, confidentiality agreements]<\/span><\/li>\n <li><strong>Vendor Management:<\/strong> <span class=\"fill-field\">[DESCRIBE: Sub-processor oversight, due diligence]<\/span><\/li>\n <\/ul>\n <\/div>\n\n <div class=\"annex-box\">\n <h3 class=\"subsection-title\">ANNEX 3: SUB-PROCESSORS<\/h3>\n <table style=\"width: 100%; border-collapse: collapse;\">\n <thead>\n <tr style=\"background: #f3f4f6;\">\n <th style=\"border: 1px solid #d1d5db; padding: 8px; text-align: left;\">Sub-processor<\/th>\n <th style=\"border: 1px solid #d1d5db; padding: 8px; text-align: left;\">Services<\/th>\n <th style=\"border: 1px solid #d1d5db; padding: 8px; text-align: left;\">Location<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td style=\"border: 1px solid #d1d5db; padding: 8px;\"><span class=\"fill-field\">[NAME]<\/span><\/td>\n <td style=\"border: 1px solid #d1d5db; padding: 8px;\"><span class=\"fill-field\">[SERVICES]<\/span><\/td>\n <td style=\"border: 1px solid #d1d5db; padding: 8px;\"><span class=\"fill-field\">[LOCATION]<\/span><\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n\n <div class=\"important-box\">\n <p><strong>\u26a0\ufe0f LEGAL NOTICE:<\/strong><\/p>\n <p style=\"margin-top: 10px;\">This Data Processing Agreement must be reviewed by legal counsel specializing in data protection law. Requirements may vary by jurisdiction, industry, and specific circumstances. This template is designed for GDPR compliance but should be adapted for other regulations (CCPA, LGPD, etc.) as applicable.<\/p>\n <\/div>\n\n <div class=\"signature-section\">\n <div class=\"signature-block\">\n <h3 class=\"subsection-title\">DATA CONTROLLER<\/h3>\n <p style=\"margin-bottom: 10px;\"><span class=\"fill-field\">[COMPANY NAME]<\/span><\/p>\n <div class=\"signature-line\"><\/div>\n <p class=\"signature-label\">Authorized Signature<\/p>\n <p style=\"margin-top: 15px;\"><strong>Name:<\/strong> <span class=\"fill-field\">[NAME]<\/span><\/p>\n <p><strong>Title:<\/strong> <span class=\"fill-field\">[TITLE]<\/span><\/p>\n <p><strong>Date:<\/strong> <span class=\"fill-field\">[DATE]<\/span><\/p>\n <\/div>\n \n <div class=\"signature-block\">\n <h3 class=\"subsection-title\">DATA PROCESSOR<\/h3>\n <p style=\"margin-bottom: 10px;\"><span class=\"fill-field\">[COMPANY NAME]<\/span><\/p>\n <div class=\"signature-line\"><\/div>\n <p class=\"signature-label\">Authorized Signature<\/p>\n <p style=\"margin-top: 15px;\"><strong>Name:<\/strong> <span class=\"fill-field\">[NAME]<\/span><\/p>\n <p><strong>Title:<\/strong> <span class=\"fill-field\">[TITLE]<\/span><\/p>\n <p><strong>Date:<\/strong> <span class=\"fill-field\">[DATE]<\/span><\/p>\n <\/div>\n <\/div>\n\n <div class=\"footer\">\n <p><strong>AiPro Institute\u2122 - Professional Business Templates<\/strong><\/p>\n <p style=\"margin-top: 5px;\">This template is provided for informational purposes only and does not constitute legal advice. Consult with a qualified data protection attorney before using this agreement.<\/p>\n <p style=\"margin-top: 10px;\">\u00a9 2026 AiPro Institute. All Rights Reserved. | Member-Only Content<\/p>\n <\/div>\n <\/div>\n<\/body>\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Data Processing Agreement (DPA) – AiPro Institute AIPRO INSTITUTE AiPro Institute\u2122 DATA PROCESSING AGREEMENT GDPR & Privacy Compliance Template GDPR COMPLIANT CCPA READY ISO 27001 EFFECTIVE DATE: [DATE] BETWEEN: [DATA CONTROLLER NAME], a [STATE\/COUNTRY] [ENTITY TYPE] with its principal place of business at [ADDRESS] (hereinafter referred to as “Data Controller” or “Controller“) AND: [DATA PROCESSOR…<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[77],"tags":[],"class_list":["post-2543","post","type-post","status-publish","format-standard","hentry","category-legal-contracts-department"],"acf":[],"_links":{"self":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/2543","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/comments?post=2543"}],"version-history":[{"count":4,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/2543\/revisions"}],"predecessor-version":[{"id":2551,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/2543\/revisions\/2551"}],"wp:attachment":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/media?parent=2543"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/categories?post=2543"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/tags?post=2543"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}