DATA PROCESSING ADDENDUM (SHORT FORM)
1. ROLES AND SCOPE
Controller: [CUSTOMER]; Processor: [PROVIDER]. Purpose: [PURPOSE]. Categories of data/subjects: see Annex A.
2. PROCESSING INSTRUCTIONS
Processor will process personal data only per Controller's documented instructions and this DPA.
3. CONFIDENTIALITY
Processor ensures personnel are bound by confidentiality regarding personal data.
4. SECURITY
Processor implements appropriate technical and organizational measures (Annex B). Breach notice to Controller without undue delay (target: [X] hours).
5. SUBPROCESSORS
Processor may engage subprocessors listed in Annex C; new subprocessors require [PRIOR APPROVAL / NOTICE + OBJECTION WINDOW].
6. DATA SUBJECT REQUESTS
Processor will assist Controller in responding to access, deletion, correction, and opt-out requests under applicable privacy laws.
7. RETURN/DELETION
On termination or Controller's request, Processor will delete or return personal data (unless retention required by law).
8. AUDITS
Controller may review Processor's compliance via reports, questionnaires, or on-site audits (on reasonable notice, during business hours).
9. CROSS-BORDER TRANSFERS
If data is transferred outside its origin jurisdiction, parties will implement required safeguards (e.g., SCCs/IDTA/Data Privacy Framework).
10. LIABILITY
Cap and exclusions follow the master agreement unless expressly modified here. Consider separate cap for data incidents: $[AMOUNT] or [X]x fees.
11. TERM
Effective as of [DATE]; coterminous with master agreement.
ANNEX A - Data/Processing Description
ANNEX B - Security Measures (encryption, access controls, logging, DR/BCP, vendor oversight)
ANNEX C - Subprocessor List (name, purpose, region)
12. ALABAMA DATA SECURITY ADDENDUM
The parties agree that, to the extent Alabama law applies:
a. Processor will implement and maintain reasonable security measures for sensitive personally identifying information as required by Alabama's Data Breach Notification Act.
b. Processor will notify Controller without undue delay, and in no event later than 24 hours, upon discovery of a breach of security affecting personal data of Alabama residents.
c. Processor will assist Controller in complying with Alabama's 45-day notification requirement to affected individuals.
d. Processor will notify Controller if it determines it can no longer meet its data security obligations and will allow reasonable assessments or audits.
e. Subprocessors will be bound by written terms at least as protective as this DPA.
[// GUIDANCE: Ensure required data security provisions are reflected in the master agreement and subprocessor terms.]