ADGM Data Processing Agreement

Definitions

"Applicable Law" means any enactment applicable in the Abu Dhabi Global Market, and any Abu Dhabi or federal UAE law having application in the Abu Dhabi Global Market, to which the Processor is subject.

"Personal Data" means any personal data that the Processor processes on behalf of the Controller in connection with the Underlying Agreement.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

Excluded Security Events

Personal Data Breaches do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful login attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.

Definitions

"Sub-processor" means any processor engaged by the Processor to process Personal Data. The "Commissioner" means the Commissioner of Data Protection of the Abu Dhabi Global Market. Other terms defined in Data Protection Laws have the same meanings here.

Roles and Scope

For the Personal Data, the Controller is the controller and the Processor is the processor. This agreement forms part of the Underlying Agreement and applies for as long as the Processor processes Personal Data. The Processing Details schedule sets out the subject matter and duration of the processing, its nature and purpose, the categories of Personal Data and data subjects, and any special category personal data.

Controller Responsibilities

The Controller is responsible for having a lawful basis for the processing and for giving data subjects the information Data Protection Laws require. Its instructions must comply with Data Protection Laws. Before the processing starts, and whenever the risk changes, the Controller must tell the Processor about any special category personal data and any other risk to individuals that the Processor needs to know.

Controller Security Assessment

The Controller is responsible for reviewing information the Processor makes available about data security and making an independent determination whether the services meet the Controller's requirements and legal obligations under Data Protection Laws.

Processing Instructions

The Processor must process Personal Data only on the Controller's documented instructions, only for the purposes and for the duration in the Processing Details schedule unless the Controller instructs otherwise, and including with regard to transfers out of the Abu Dhabi Global Market, unless Applicable Law requires it to do otherwise. In that case it must tell the Controller of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Controller may give further documented instructions throughout the processing, consistent with this agreement and the Underlying Agreement.

The Processor must immediately tell the Controller if, in its opinion, an instruction infringes Data Protection Laws. The Processor may suspend the affected processing until the Controller confirms, changes or withdraws the instruction.

Confidentiality

The Processor must give its personnel access to Personal Data only to the extent strictly necessary to perform, manage and monitor the Underlying Agreement, and must ensure that each person authorised to process Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

Security

The Processor must implement at least the measures in the Security Measures schedule to protect Personal Data against a Personal Data Breach, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to data subjects. The Processor must regularly test and review those measures and may update them, provided no update materially reduces the overall level of protection.

Special Category Personal Data

Where the processing involves special category personal data, the Processor must apply the specific restrictions and additional safeguards recorded in the Processing Details schedule, such as stricter access controls, access logging, restrictions on onward transfer and additional security measures.

Sub-processors

The Controller gives general written authorisation for the Processor to engage the Sub-processors listed in the Approved Sub-processors schedule and others notified under this clause. The Processor must specifically inform the Controller in writing of any intended addition or replacement at least 30 days in advance, with the information the Controller needs to decide whether to object. The Controller may object on reasonable data protection grounds within that period. If the objection is not resolved before the change takes effect, the Controller may terminate the affected services on written notice without liability for charges for the period after termination.

The Processor must engage each Sub-processor under a written contract imposing in substance the same data protection obligations as this agreement, including a right for the Controller, if the Processor has factually disappeared, ceased to exist in law or become insolvent, to terminate that contract and instruct the Sub-processor to erase or return the Personal Data. The Processor remains fully responsible to the Controller for each Sub-processor's performance and must tell the Controller of any failure by a Sub-processor to meet its obligations. On request, the Processor must give the Controller a copy of that contract, redacted where needed to protect confidential information.

Assistance

The Processor must promptly notify the Controller of any request it receives from a data subject and must not respond to it unless the Controller authorises it. Taking into account the nature of the processing, the Processor must assist the Controller, following its instructions, to respond to data subjects' requests to exercise their rights.

Third-Party Requests

The Processor must notify the Controller of the inquiry or request and must not respond without the Controller's prior consent, except where Applicable Law requires or permits otherwise. This includes a judicial, administrative or regulatory order about Personal Data where notifying the Controller is not prohibited by Applicable Law. If allowed by Applicable Law, the Processor must follow the Controller's reasonable instructions about the request, including by providing status updates and other information reasonably requested by the Controller. The Processor must cooperate with and provide reasonable assistance to the Controller, at the Controller's expense, in any legal response or other procedural action taken in response to a third-party request about the Processor's processing of Personal Data under this agreement.

Assistance

Taking into account the nature of the processing and the information available to it, the Processor must assist the Controller with security of processing, data protection impact assessments, prior consultation with the Commissioner, and notifying Personal Data Breaches to the Commissioner and data subjects. It must also tell the Controller without delay if it becomes aware that Personal Data it processes is inaccurate or outdated. The Controller must pay the Processor's reasonable charges, agreed in advance, for assistance beyond the services under the Underlying Agreement, unless the assistance is needed because of the Processor's breach of this agreement.

Personal Data Breaches

The Processor must notify the Controller of a Personal Data Breach without undue delay, and in any event within 48 hours, after becoming aware of it. The notice must describe, so far as then known, the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, a contact point for more information, the likely consequences and the measures taken or proposed to address the breach and mitigate its effects. Further information must follow without undue delay as it becomes available.

The Processor must promptly take reasonable steps to contain, investigate and mitigate a Personal Data Breach and must assist the Controller to notify the Commissioner and affected data subjects where required. Unless the law requires otherwise, the Processor must not notify the Commissioner, a data subject or any other third party of the breach without the Controller's prior written approval.

No Admission by Breach Response

The Processor's notification of or response to a Personal Data Breach as required by this agreement will not be construed as an acknowledgment by the Processor of any fault or liability for the Personal Data Breach.

International Transfers

The Processor must not transfer Personal Data outside the Abu Dhabi Global Market, including to onshore UAE and including by allowing access from outside it, except on the Controller's documented instructions or to meet a specific requirement of Applicable Law, and in compliance with Part V of the ADGM Data Protection Regulations 2021. The Controller instructs transfers to the locations in the Processing Details schedule and to Sub-processors authorised under the Sub-processors clause at their notified locations.

Where a transfer is to a jurisdiction the Commissioner has not found adequate, the parties must, before it takes place, put in place an appropriate safeguard under Part V, such as the standard contractual clauses adopted by the Commissioner or the Commissioner's Addendum to the European Commission's standard contractual clauses, completed from the schedules to this agreement. The Processor may meet this for a transfer to a Sub-processor by entering into the Commissioner's standard contractual clauses with it.

Information and Audit

The Processor must deal promptly and adequately with the Controller's enquiries about the processing and make available all information necessary to demonstrate compliance with this agreement and section 26 of the ADGM Data Protection Regulations 2021. The parties must make that information, including the results of any audit, available to the Commissioner on request. The Processor must permit and contribute to audits, including inspections, by the Controller or an independent auditor it mandates, at reasonable intervals no more than once in any 12-month period or where there are indications of non-compliance, on at least 30 days written notice. In deciding on an audit, the Controller may take into account the Processor's relevant certifications. Each party bears its own audit costs unless the audit reveals a material breach by the Processor.

Return and Deletion

On termination or expiry of the Underlying Agreement, the Processor must, at the Controller's choice, delete all Personal Data and certify that it has done so, or return all Personal Data to the Controller and delete existing copies, within 30 days, unless Applicable Law requires storage. Until the Personal Data is deleted or returned, the Processor must continue to comply with this agreement.

Deletion During the Services

The Processor must enable the Controller to delete Personal Data in a manner consistent with the functionality of the services. The Processor must comply with that instruction as soon as reasonably practicable, except where further storage of Personal Data is required by Applicable Law.

Liability

Each party's liability arising out of or in connection with this agreement is subject to the limitations and exclusions of liability in the Underlying Agreement, and claims under both count together towards any cap. Nothing in this agreement limits liability to data subjects under Data Protection Laws or any liability that cannot be limited or excluded by law.

Related-Party Claims

Any claim made against the Processor or its Affiliates arising out of or related to this agreement may only be brought by the Controller entity that is a party to the Underlying Agreement.

Term and Termination

This agreement continues until the Processor has stopped processing Personal Data and has returned or deleted it under the Return and Deletion clause. The Processor must promptly tell the Controller if it cannot comply with this agreement. If the Processor breaches this agreement, the Controller may instruct it to suspend the processing until it complies. The Controller may terminate the affected services on written notice if compliance is not restored within a reasonable time and in any event within one month after suspension, if the Processor is in substantial or persistent breach of this agreement or Data Protection Laws, or if it fails to comply with a binding decision of a competent court or the Commissioner. The Processor may terminate the affected services on written notice if the Controller insists on an instruction that the Processor has told it infringes Data Protection Laws.

General

If this agreement conflicts with the Underlying Agreement on the processing of Personal Data, this agreement prevails, and any transfer clauses entered into under the International Transfers clause prevail over both. Notices are given as the Underlying Agreement provides, but Personal Data Breach notifications and data subject requests may also be sent to the privacy contacts in the Processing Details schedule. No person other than the parties may enforce this agreement.

Changes to Data Protection Laws

The parties must work together in good faith to negotiate an amendment to this agreement as either party reasonably considers necessary to address the requirements of Data Protection Laws from time to time.

Governing Law and Jurisdiction

This agreement and any non-contractual obligations arising out of or in connection with it are governed by the laws of the Abu Dhabi Global Market. The ADGM Courts have exclusive jurisdiction to settle any dispute arising out of or in connection with this agreement.