DPA Short Form Transfer Addendum - Florida (Operational Compliance)

DPA SHORT FORM TRANSFER ADDENDUM -- FLORIDA

Operational Compliance Format -- Article Numbering

Addendum Effective Date: [__/__/____]

Reference Agreement: [________________________________] dated [__/__/____] (the "Agreement")

Transferor (Controller): [________________________________] ("Transferor")

Transferee (Processor): [________________________________] ("Transferee")

This Addendum establishes the operational compliance framework for transfers of Personal Data involving Florida consumers under the FDBR (effective July 1, 2024) and FIPA.

ARTICLE I: DEFINITIONS

1.1 "Personal Data" -- Fla. Stat. 501.702(17); linked or reasonably linkable to identified/identifiable individual.

1.2 "Sensitive Data" -- Fla. Stat. 501.702(25); racial/ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship/immigration status, genetic data, biometric data, known child data, precise geolocation.

1.3 "Controller" -- Fla. Stat. 501.702(7). 1.4 "Processor" -- Fla. Stat. 501.702(19).

1.5 "Sale" -- Fla. Stat. 501.702(23). 1.6 "Targeted Advertising" -- Fla. Stat. 501.702(27).

1.7 "Known Child" -- Under 13 (COPPA) or 13-18 (FDBR enhanced protections).

1.8 "Personal Information" (FIPA) -- Fla. Stat. 501.171(1)(g); name + SSN, financial account, DL/ID, medical history, health insurance, email with password.

1.9 "Data Breach" -- Unauthorized access per Fla. Stat. 501.171(1)(a).

ARTICLE II: OPERATIONAL SCOPE

2.1 FDBR Applicability Assessment:

FDBR Status: ☐ Applicable ☐ Not Applicable ☐ Adopted as Best Practice

2.2 Pre-Transfer Compliance Checklist:

☐ Written contract executed (this Addendum; Fla. Stat. 501.712)
☐ Processing instructions documented
☐ Privacy notice published per 501.709
☐ Sensitive Data consent obtained (if applicable)
☐ Children's data consent obtained (if applicable)
☐ FIPA compliance verified
☐ Data inventory completed (Exhibit C)
☐ Technical measures verified (Exhibit B)
☐ Subprocessor list reviewed
☐ Consumer rights workflow established (note: 15-day extension only)
☐ Breach notification plan documented (note: 30-day FIPA deadline)

2.3 Transfer Type: ☐ Controller-to-Processor ☐ Controller-to-Controller ☐ Processor-to-Sub-Processor

2.4 Purpose: [________________________________]

2.5 Data Categories:

☐ Identifiers ☐ Online identifiers ☐ Commercial data ☐ Financial data
☐ Employment data ☐ Geolocation ☐ Internet activity ☐ Biometric data
☐ Health data ☐ Education data ☐ Inferences ☐ Sensitive Data
☐ Children's data ☐ FIPA Personal Information

2.6 Consumer Categories: ☐ Customers ☐ Employees ☐ End Users ☐ Business Contacts ☐ Children under 13 ☐ Children 13-18 ☐ Other: [________________________________]

2.7 Duration: Agreement term plus [____] day wind-down.

ARTICLE III: COMPLIANCE FRAMEWORK

3.1 FDBR Statutory Contract Matrix (Fla. Stat. 501.712):

3.2 Legal Basis: ☐ Consent ☐ Contractual ☐ Legal obligation ☐ Vital interests ☐ Legitimate interests

3.3 Sensitive Data: ☐ Consent obtained ☐ N/A

3.4 Children's Data: ☐ Under 13 COPPA consent ☐ 13-18 affirmative authorization ☐ N/A

3.5 International Transfer: ☐ DPF ☐ SCCs Module [____] ☐ UK Addendum ☐ N/A

ARTICLE IV: DATA CLASSIFICATION

4.1 Standard Data:

4.2 Sensitive Data (501.702(25)):

4.3 FIPA Personal Information (501.171(1)(g)):

ARTICLE V: TRANSFEROR OPERATIONS

5.1 Privacy Notice Checklist (501.711):

☐ Data categories disclosed ☐ Purposes disclosed ☐ Consumer rights disclosed
☐ Third-party recipients disclosed ☐ Sale/targeting opt-out disclosed ☐ Contact info provided

5.2 Data Minimization. Collection limited to what is adequate, relevant, and reasonably necessary for disclosed purposes (501.71(1)(a)).

5.3 Opt-Out Forwarding. Notify Transferee within [____] business days.

5.4 Children's Data Protocols:

5.5 Monitoring Schedule:

ARTICLE VI: TRANSFEREE OPERATIONS

6.1 Required Actions:

☐ Process only per documented instructions
☐ Maintain confidentiality (501.712)
☐ Implement contractually required security and support controller compliance (501.712)
☐ Assist with consumer rights (45-day + 15-day timeline)
☐ Delete/return data on termination (501.712)
☐ Provide compliance information (501.712)
☐ Cooperate with reasonable assessments (501.712)
☐ Children's data protections (if applicable)

6.2 Prohibited Actions:

☐ NOT Sell Personal Data without authorization
☐ NOT Process for Targeted Advertising without authorization
☐ NOT Process for unauthorized purposes
☐ NOT disclose to unauthorized third parties
☐ NOT Process children's Sensitive Data without proper authorization

6.3 Confidentiality. All personnel bound by confidentiality duty as required by the processor contract (501.712).

6.4 Children's Data Operations (if applicable):

6.5 Inability to Comply. Promptly notify Transferor. Transferor may suspend and/or terminate.

ARTICLE VII: TECHNICAL MEASURES

7.1 Security Controls:

7.2 Enhanced Measures (Sensitive/Children's Data). Field-level encryption; tokenization; real-time alerts; segregated storage; age verification; annual PIA.

ARTICLE VIII: CONSUMER RIGHTS OPERATIONS

8.1 Critical Timeline Note: Florida allows only a 15-day extension (not 45 days). Plan accordingly.

8.2 Workflow:

8.3 Rights Matrix:

8.4 Non-Discrimination. No adverse treatment (501.708(6)).

ARTICLE IX: SUBPROCESSOR MANAGEMENT

9.1 Authorization: ☐ Specific ☐ General (with [____] days' notice)

9.2 Subprocessor Tracker:

9.3 Flow-Down Checklist:

☐ Processing per instructions ☐ Confidentiality ☐ Security measures
☐ Consumer rights cooperation ☐ Breach notification ☐ Audit cooperation
☐ Deletion/return ☐ Children's data protections (if applicable)

9.4 Liability. Transferee fully liable.

ARTICLE X: DATA BREACH RESPONSE

10.1 Timeline (FIPA Critical: 30-Day Deadline):

10.2 Breach Checklist:

☐ Breach contained
☐ Transferor notified
☐ Scope identified
☐ FIPA Personal Information involvement assessed
☐ Children's data involvement assessed
☐ Law enforcement evaluation
☐ Consumer notice drafted (per 501.171)
☐ AG notice prepared (if 500+ FL residents)
☐ CRA notice prepared (if 1,000+ individuals)
☐ Credit monitoring arranged
☐ Root cause analysis
☐ Remediation plan

10.3 Penalties. FIPA: up to $500,000 per breach ($1,000/day first 30 days, $50,000 per subsequent 30-day period up to 180 days). FDBR: up to $50,000 per violation.

ARTICLE XI: DATA RETENTION AND DELETION

11.1 Schedule:

11.2 Deletion Checklist:

☐ Election received ☐ Primary data purged ☐ Backups scheduled (within [____] months)
☐ Children's data expedited deletion ☐ Subprocessors notified ☐ Certification delivered

11.3 Legal Hold. Permitted if required; Transferor notified; minimum data; protections continue.

ARTICLE XII: AUDIT AND MONITORING

12.1 Compliance Information. Available upon request as required by the processor contract (501.712).

12.2 Assessment Cooperation. Reasonable assessments by the controller or its designated assessor allowed as provided in the processor contract (501.712).

12.3 Schedule:

12.4 Evidence. SOC 2; ISO 27001; pen test; SIG; PIA; training records.

12.5 On-Site. [____] per year; [____] days' notice; NDA; cost allocation per Agreement.

12.6 Remediation. [____] days; evidence provided.

ARTICLE XIII: CROSS-BORDER

13.1 Interstate. FDBR applies regardless of Processing location.

13.2 Location: ☐ US only ☐ US + EEA/UK ☐ Specific: [________________________________] ☐ No restriction

13.3 Relocation Notice. [____] days prior.

ARTICLE XIV: LIABILITY

14.1 Mutual indemnification.

14.2 Transferee: FDBR penalties ($50,000/violation); FIPA penalties (up to $500,000/breach); notification/monitoring costs; children's data claims; investigation costs.

14.3 Enforcement. FL Dept. of Legal Affairs. No private right of action.

14.4 Cap. Agreement cap except for children's data violations, willful misconduct, unauthorized Sale.

ARTICLE XV: TERM AND TERMINATION

15.1 Term. Coterminous. 15.2 Cure. [____] days. 15.3 Survival. Articles I, VI, VII, VIII, X, XI, XII, XIV.

ARTICLE XVI: EXECUTION

TRANSFEROR:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Organization: [________________________________]
Date: [__/__/____]

TRANSFEREE:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Organization: [________________________________]
Date: [__/__/____]

EXHIBIT A: RISK ASSESSMENT

Overall: ☐ Proceed ☐ Proceed with measures ☐ Do not proceed

EXHIBIT B: TECHNICAL MEASURES

EXHIBIT C: DATA INVENTORY

SOURCES AND REFERENCES

• FDBR -- Florida Senate
• FIPA (501.171)
• White & Case FDBR
• Usercentrics FDBR Guide
• Thompson Hine FDBR/FIPA