DPA Short Form Transfer Addendum - Florida (Operational Compliance)

DPA SHORT FORM TRANSFER ADDENDUM -- FLORIDA

Operational Compliance Format -- Article Numbering

Addendum Effective Date: [__/__/____]

Reference Agreement: [________________________________] dated [__/__/____] (the "Agreement")

Transferor (Controller): [________________________________] ("Transferor")

Transferee (Processor): [________________________________] ("Transferee")

This Addendum establishes the operational compliance framework for transfers of Personal Data involving Florida consumers under the FDBR (effective July 1, 2024) and FIPA.

ARTICLE I: DEFINITIONS

1.1 "Personal Data" -- Fla. Stat. 501.702(17); linked or reasonably linkable to identified/identifiable individual.

1.2 "Sensitive Data" -- Fla. Stat. 501.702(25); racial/ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship/immigration status, genetic data, biometric data, known child data, precise geolocation.

1.3 "Controller" -- Fla. Stat. 501.702(7). 1.4 "Processor" -- Fla. Stat. 501.702(19).

1.5 "Sale" -- Fla. Stat. 501.702(23). 1.6 "Targeted Advertising" -- Fla. Stat. 501.702(27).

1.7 "Known Child" -- Under 13 (COPPA) or 13-18 (FDBR enhanced protections).

1.8 "Personal Information" (FIPA) -- Fla. Stat. 501.171(1)(g); name + SSN, financial account, DL/ID, medical history, health insurance, email with password.

1.9 "Data Breach" -- Unauthorized access per Fla. Stat. 501.171(1)(a).

ARTICLE II: OPERATIONAL SCOPE

2.1 FDBR Applicability Assessment:

FDBR Status: ☐ Applicable ☐ Not Applicable ☐ Adopted as Best Practice

2.2 Pre-Transfer Compliance Checklist:

☐ Written contract executed (this Addendum; Fla. Stat. 501.714)
☐ Processing instructions documented
☐ Privacy notice published per 501.709
☐ Sensitive Data consent obtained (if applicable)
☐ Children's data consent obtained (if applicable)
☐ FIPA compliance verified
☐ Data inventory completed (Exhibit C)
☐ Technical measures verified (Exhibit B)
☐ Subprocessor list reviewed
☐ Consumer rights workflow established (note: 15-day extension only)
☐ Breach notification plan documented (note: 30-day FIPA deadline)

2.3 Transfer Type: ☐ Controller-to-Processor ☐ Controller-to-Controller ☐ Processor-to-Sub-Processor

2.4 Purpose: [________________________________]

2.5 Data Categories:

☐ Identifiers ☐ Online identifiers ☐ Commercial data ☐ Financial data
☐ Employment data ☐ Geolocation ☐ Internet activity ☐ Biometric data
☐ Health data ☐ Education data ☐ Inferences ☐ Sensitive Data
☐ Children's data ☐ FIPA Personal Information

2.6 Consumer Categories: ☐ Customers ☐ Employees ☐ End Users ☐ Business Contacts ☐ Children under 13 ☐ Children 13-18 ☐ Other: [________________________________]

2.7 Duration: Agreement term plus [____] day wind-down.

ARTICLE III: COMPLIANCE FRAMEWORK

3.1 FDBR Statutory Contract Matrix (Fla. Stat. 501.714):

3.2 Legal Basis: ☐ Consent ☐ Contractual ☐ Legal obligation ☐ Vital interests ☐ Legitimate interests

3.3 Sensitive Data: ☐ Consent obtained ☐ N/A

3.4 Children's Data: ☐ Under 13 COPPA consent ☐ 13-18 affirmative authorization ☐ N/A

3.5 International Transfer: ☐ DPF ☐ SCCs Module [____] ☐ UK Addendum ☐ N/A

ARTICLE IV: DATA CLASSIFICATION

4.1 Standard Data:

4.2 Sensitive Data (501.702(25)):

4.3 FIPA Personal Information (501.171(1)(g)):

ARTICLE V: TRANSFEROR OPERATIONS

5.1 Privacy Notice Checklist (501.709):

☐ Data categories disclosed ☐ Purposes disclosed ☐ Consumer rights disclosed
☐ Third-party recipients disclosed ☐ Sale/targeting opt-out disclosed ☐ Contact info provided

5.2 Data Minimization. Adequate, relevant, reasonably necessary (501.710(1)).

5.3 Opt-Out Forwarding. Notify Transferee within [____] business days.

5.4 Children's Data Protocols:

5.5 Monitoring Schedule:

ARTICLE VI: TRANSFEREE OPERATIONS

6.1 Required Actions:

☐ Process only per documented instructions
☐ Maintain confidentiality (501.714(2)(a))
☐ Implement reasonable security (501.714(4))
☐ Assist with consumer rights (45-day + 15-day timeline)
☐ Delete/return data on termination (501.714(2)(b))
☐ Provide compliance information (501.714(2)(c))
☐ Cooperate with audits (501.714(2)(d))
☐ Children's data protections (if applicable)

6.2 Prohibited Actions:

☐ NOT Sell Personal Data without authorization
☐ NOT Process for Targeted Advertising without authorization
☐ NOT Process for unauthorized purposes
☐ NOT disclose to unauthorized third parties
☐ NOT Process children's Sensitive Data without proper authorization

6.3 Confidentiality. All personnel bound by confidentiality duty (501.714(2)(a)).

6.4 Children's Data Operations (if applicable):

6.5 Inability to Comply. Promptly notify Transferor. Transferor may suspend and/or terminate.

ARTICLE VII: TECHNICAL MEASURES

7.1 Security Controls:

7.2 Enhanced Measures (Sensitive/Children's Data). Field-level encryption; tokenization; real-time alerts; segregated storage; age verification; annual PIA.

ARTICLE VIII: CONSUMER RIGHTS OPERATIONS

8.1 Critical Timeline Note: Florida allows only a 15-day extension (not 45 days). Plan accordingly.

8.2 Workflow:

8.3 Rights Matrix:

8.4 Non-Discrimination. No adverse treatment (501.708(6)).

ARTICLE IX: SUBPROCESSOR MANAGEMENT

9.1 Authorization: ☐ Specific ☐ General (with [____] days' notice)

9.2 Subprocessor Tracker:

9.3 Flow-Down Checklist:

☐ Processing per instructions ☐ Confidentiality ☐ Security measures
☐ Consumer rights cooperation ☐ Breach notification ☐ Audit cooperation
☐ Deletion/return ☐ Children's data protections (if applicable)

9.4 Liability. Transferee fully liable.

ARTICLE X: DATA BREACH RESPONSE

10.1 Timeline (FIPA Critical: 30-Day Deadline):

10.2 Breach Checklist:

☐ Breach contained
☐ Transferor notified
☐ Scope identified
☐ FIPA Personal Information involvement assessed
☐ Children's data involvement assessed
☐ Law enforcement evaluation
☐ Consumer notice drafted (per 501.171)
☐ AG notice prepared (if 500+ FL residents)
☐ CRA notice prepared (if 1,000+ individuals)
☐ Credit monitoring arranged
☐ Root cause analysis
☐ Remediation plan

10.3 Penalties. FIPA: up to $500,000 per breach ($1,000/day first 30 days, $50,000 per subsequent 30-day period up to 180 days). FDBR: up to $50,000 per violation.

ARTICLE XI: DATA RETENTION AND DELETION

11.1 Schedule:

11.2 Deletion Checklist:

☐ Election received ☐ Primary data purged ☐ Backups scheduled (within [____] months)
☐ Children's data expedited deletion ☐ Subprocessors notified ☐ Certification delivered

11.3 Legal Hold. Permitted if required; Transferor notified; minimum data; protections continue.

ARTICLE XII: AUDIT AND MONITORING

12.1 Compliance Information. Available upon request (501.714(2)(c)).

12.2 Audit Cooperation. Reasonable audits allowed (501.714(2)(d)).

12.3 Schedule:

12.4 Evidence. SOC 2; ISO 27001; pen test; SIG; PIA; training records.

12.5 On-Site. [____] per year; [____] days' notice; NDA; cost allocation per Agreement.

12.6 Remediation. [____] days; evidence provided.

ARTICLE XIII: CROSS-BORDER

13.1 Interstate. FDBR applies regardless of Processing location.

13.2 Location: ☐ US only ☐ US + EEA/UK ☐ Specific: [________________________________] ☐ No restriction

13.3 Relocation Notice. [____] days prior.

ARTICLE XIV: LIABILITY

14.1 Mutual indemnification.

14.2 Transferee: FDBR penalties ($50,000/violation); FIPA penalties (up to $500,000/breach); notification/monitoring costs; children's data claims; investigation costs.

14.3 Enforcement. FL Dept. of Legal Affairs. No private right of action.

14.4 Cap. Agreement cap except for children's data violations, willful misconduct, unauthorized Sale.

ARTICLE XV: TERM AND TERMINATION

15.1 Term. Coterminous. 15.2 Cure. [____] days. 15.3 Survival. Articles I, VI, VII, VIII, X, XI, XII, XIV.

ARTICLE XVI: EXECUTION

TRANSFEROR:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Organization: [________________________________]
Date: [__/__/____]

TRANSFEREE:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Organization: [________________________________]
Date: [__/__/____]

EXHIBIT A: RISK ASSESSMENT

Overall: ☐ Proceed ☐ Proceed with measures ☐ Do not proceed

EXHIBIT B: TECHNICAL MEASURES

EXHIBIT C: DATA INVENTORY

SOURCES AND REFERENCES

• FDBR -- Florida Senate
• FIPA (501.171)
• White & Case FDBR
• Usercentrics FDBR Guide
• Thompson Hine FDBR/FIPA