عربي

Home › Data Protection Amendment

Data protection amendment

In line with General Data Protection Regulation, the below mentioned obligations are drafted which will be applicable on both the parties

1. Definitions

For the purposes of the clauses:

  • “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC
  • The “data exporter” shall mean the controller who transfers the personal data;
  • The “data importer” shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring adequate protection;
  • “Clauses” shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements
  • “Data Protection Legislation” means the GDPR for as long as it is directly applicable in the European Union and any national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in India, and then any successor legislation.
  • “Data Subject” means a data subject as defined by the Data Protection Legislation.
  • “Personal Data” means personal data as defined by the Data Protection Legislation.

Note: The terms “data exporter” and “data importers” are strictly for use within the context of this amendment which should be interpreted only as defined above, and do not carry the same meaning as defined under any other regulations.

2. Obligations of the data exporter
The data exporter warrants and undertakes that:

  1. The personal data have been collected, processed and transferred in accordance with the laws applicable to the data exporter.
  2. It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses.
  3. It will provide the data importer, when so requested, with copies of relevant data protection laws or references to them (where relevant, and not including legal advice) of the country in which the data exporter is established.

3. Obligations of the data importer
The data importer warrants and undertakes that:

  1. It will have in place appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.
  2. It will have in place procedures so that any third party it authorises to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on instructions from the data importer. This provision does not apply to persons authorised or required by law or regulation to have access to the personal data.
  3. It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws.
  4. It will process the personal data for purposes described in the privacy policy and terms and conditions, and has the legal authority to give the warranties and fulfil the undertakings set out in these clauses.
  5. It will identify to the data exporter a contact point within its organisation authorised to respond to enquiries concerning processing of the personal data, and will cooperate in good faith with the data exporter, the data subject and the authority concerning all such enquiries within a reasonable time.
  6. It will not disclose or transfer the personal data to a third party data controller without ensuring that adequate and equivalent safeguards to the Personal Data.

4. Law applicable to the clauses
These clauses shall be governed by the law of the country in which the data exporter is established.

5. Resolution of disputes with data subjects or the authority

  1. In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.
  2. The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.
  3. Each party shall abide by a decision of a competent court of the data exporter’s country of establishment or of the authority which is final and against which no further appeal is possible.

6. Termination

  1. In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated.
  2. In the event that:
    1. the transfer of personal data to the data importer has been temporarily suspended by the data exporter for longer than one month pursuant to paragraph (a);
    2. compliance by the data importer with these clauses would put it in breach of its legal or regulatory obligations in the country of import;
    3. the data importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;
    4. a final decision against which no further appeal is possible of a competent court of the data exporter’s country of establishment or of the authority rules that there has been a breach of the clauses by the data importer or the data exporter; or
    5. a petition is presented for the administration or winding up of the data importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the data importer may also terminate these clauses.
  3. Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article 25(6) of Directive 95/46/C (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes directly applicable in such country.
  4. The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

7. Description of the Transfer
The details of the transfer and of the personal data are specified in Privacy policy and terms and conditions.