Data Processing Agreement

Data Processing Agreement

〔Controllerの名称〕 (the Controller) and 〔Processorの名称〕 (the Processor) agree as of 〔契約締結日〕 as follows.

Article 1. Scope, Instructions and Processing Details

1.1 This Agreement governs Processor’s processing of personal data for Controller in providing the services identified in the Schedule under the identified services agreement (the Services Agreement). It does not authorize Processor to determine independent purposes for that data.

1.2 Annex 1 forms part of this Agreement and records the processing details.

1.3 Controller’s documented instructions comprise this Agreement, Annex 1, and subsequent written instructions from its notice contact, including instructions given through the documented service configuration within Annex 1’s scope.

1.4 Processor shall process the data only on those instructions, not for its own purposes.

1.5 If applicable law requires other processing, Processor shall inform Controller before processing unless that law prohibits notice.

1.6 Processor shall promptly inform Controller if, in its opinion, an instruction infringes applicable data protection law and may suspend the affected instruction pending clarification.

1.7 Controller is responsible for its authority to provide the data and the lawfulness of its instructions.

1.8 For personal-data processing obligations, this Agreement prevails over a conflicting term of the Services Agreement; it does not otherwise amend that agreement’s fees or service scope.

Article 2. Security, Assistance and Subprocessors

2.1 Processor shall implement the measures in Annex 1, restrict access to authorized personnel under confidentiality obligations, and periodically test the effectiveness of its safeguards.

2.2 Processor shall notify the Controller breach contact without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting the processing. It shall provide the known nature, affected data and persons, likely consequences, measures taken, and a contact for follow-up; it shall supply missing information as it becomes available and cooperate in containment, investigation and remediation.

2.3 Processor shall promptly forward requests from data subjects unless legally prohibited and reasonably assist Controller, taking account of the information available to Processor, with requests, security obligations, breach notifications and assessments concerning this processing.

2.4 Processor shall not appoint or replace a subprocessor except under Annex 2. It shall impose equivalent relevant written data-protection obligations on each approved subprocessor and remain responsible to Controller for that subprocessor’s performance.

Article 3. Audit, Transfers and Deletion

3.1 Processor shall provide information reasonably necessary to demonstrate its performance of this Agreement.

3.2 Controller may, on reasonable notice, audit the relevant processing itself or through an independent confidential auditor, including an inspection where documentary evidence is insufficient; the parties shall protect other customers’ data and avoid unreasonable disruption. A transfer or remote access outside an authorized processing location, including access by a subprocessor, may begin only after the parties have recorded the actual route and recipient in Annex 2 and completed any transfer instrument and other measures required by the applicable law; authorization of a subprocessor alone does not authorize a transfer.

3.3 Within 10 days after the relevant services or this Agreement ends, whichever occurs first, Controller shall instruct Processor to return or delete the affected personal data.

3.4 Processor shall complete the instructed return or deletion, including copies held by subprocessors, within 30 days after receiving that instruction and certify completion. If no instruction is received within 10 days, Processor shall send a reminder and provide a further 10 days for an instruction. If none is received, Processor shall delete the data and subprocessor copies within 30 days after that further period expires and certify completion.

3.5 A return instruction requires deletion of remaining copies within the same completion period.

3.6 Until completion, Processor shall protect the data and cease other processing. Backups shall be isolated from use and deleted within 90 days after the relevant termination; if restored for disaster recovery, the affected data shall promptly be deleted again.

3.7 If law requires retention, Processor shall identify the retained data and legal basis to Controller unless prohibited, isolate it from ordinary use, continue to protect it, and delete it when retention is no longer required.

Article 4. Change Control and Notices

4.1 A change to Annex 1’s processing scope, authorized locations or material security measures requires the parties’ written agreement before the changed processing begins, except for a more protective security measure that does not materially impair the services.

4.2 A subprocessor change follows Annex 2.

4.3 This Agreement does not change prices or license rights under the Services Agreement.

4.4 Notices and instructions under this Agreement shall be sent to the respective Schedule email addresses in a form that preserves evidence of sending and delivery; breach notices shall also be sent to the stated breach contact. A notice is received when its delivery to the stated address is recorded, unless the sender receives a delivery-failure notice. Each party shall promptly notify the other of a changed address.

Article 5. Confidentiality and Compliance

5.1 Each party shall use the other party’s nonpublic information only to perform this Agreement or the identified Services Agreement, restrict access to personnel and approved subcontractors with a need to know, and apply reasonable safeguards. This permission does not expand Processor’s authority to use personal data beyond Article 1.

5.2 Mandatory legal disclosures are permitted after advance notice when lawful.

5.3 Each party shall comply with laws applicable to its own performance.

Article 6. Term, Termination and Consequences

6.1 This Agreement starts on the effective date and continues while Processor processes personal data for Controller under the identified Services Agreement, unless terminated earlier.

6.2 Either party may terminate this Agreement for the other’s material breach that remains uncured 30 days after written notice describing it, or immediately if the breach cannot be cured.

6.3 Upon termination of this Agreement, Processor shall stop the affected processing; continued processing requires a new valid arrangement.

6.4 Ending the services or this Agreement triggers Article 3’s return-or-deletion process.

6.5 Termination does not extinguish accrued obligations under either agreement.

6.6 Article 2’s security, confidentiality of personnel, breach notification, assistance and subprocessor-management obligations survive for as long as any personal data is retained.

6.7 Articles 3 (until completion of return or deletion and during lawful retention), 5, 7 and this Article survive termination; protections for retained personal data continue for as long as it is held.

6.8 Service fees, license rights and any refund remain governed by the Services Agreement, subject to Annex 2’s express remedy for an unresolved subprocessor objection.

Article 7. Liability and Disputes

7.1 A party is liable for direct losses caused by its breach of this Agreement, subject to the aggregate cap stated in the Schedule for claims under this Agreement. The cap does not apply to fraud, willful misconduct, or liability that cannot lawfully be limited.

7.2 The parties shall first escalate a dispute through their Schedule notice contacts and allow 15 days for discussion; either may seek urgent relief without waiting.

7.3 The governing law and exclusive forum stated in the Schedule apply, subject to mandatory law.

【Schedule】

Complete every applicable factual field before signature. Enter “none” for no approved subprocessors or restricted transfers, and “not applicable” for a transfer instrument only where no such transfer is planned. Identify referenced instruments by title, parties, version and date; listing an instrument does not itself establish its legal sufficiency.

Services Agreement, including parties, title, version and date：〔Services Agreementの特定情報〕

Controller notice email：〔Controllerの通知先メールアドレス〕

Processor notice email：〔Processorの通知先メールアドレス〕

Controller breach notice email：〔Controllerの事故通知先メールアドレス〕

Aggregate liability cap for this Agreement (amount and currency)：〔責任上限額〕 〔責任上限の通貨〕

Governing law：〔準拠法〕

Exclusive forum：〔専属的合意管轄〕

【Annex 1. Processing Details and Security】

Services and processing purpose：〔サービスと処理目的〕

Categories of data subjects：〔データ主体の区分〕

Categories of personal data：〔個人データの種類〕

Sensitive or specially regulated data, if any：〔要配慮データの種類〕

Nature and operations of processing：〔処理の性質と内容〕

Authorized processing and support-access locations：〔処理・サポートアクセス拠点〕

Duration：From the effective date while the identified services require processing, followed by Article 3’s return, deletion or lawful retention.

Processor shall maintain at least access controls based on job need, individual authentication, access logging, encryption in transit and at rest, backup and restoration procedures, vulnerability management, personnel confidentiality, and periodic testing of these controls. It shall make information on the implementation of these measures available under Article 3. Any additional measures required for the recorded data and applicable law must be agreed in writing before the affected processing begins; this baseline does not represent a determination that it suffices for every category of data.

【Annex 2. Subprocessors and Transfers】

Approved subprocessors: legal name, service, data accessed and access country for each; or none：〔承認済み再委託先の一覧〕

Planned restricted transfer or remote-access route: origin, destination and recipient for each; or none：〔国外移転・アクセス経路〕

Executed transfer instrument or other applicable mechanism: parties, title, version and date for each route; or not applicable if no route：〔移転手段の特定情報〕

Only listed subprocessors are authorized on signature. Processor shall give the Controller notice email at least 30 days’ advance notice of a proposed addition, replacement or changed access country, with its name, function, data and location.

Controller may object on reasonable data-protection grounds within 15 days after receipt. Processor shall not give the proposed recipient access while an objection is unresolved.

The parties shall seek a workable alternative; if none is available before the proposed change, Controller may terminate the affected services without an early-termination charge, and Processor shall refund prepaid fees for the unused affected services under the Services Agreement. Processor shall not begin a restricted transfer or remote access until Article 3’s applicable conditions are met.

If Controller has not objected within the 15-day period, the proposed change is authorized on the notified effective date, no earlier than the end of the 30-day notice period. Processor shall provide a dated written update to this Annex before access begins, and both parties shall preserve the prior and updated versions.

If Controller objects, access requires a written resolution of the objection or express approval. Neither silence nor subprocessor authorization satisfies Article 3’s separate transfer conditions.

Date: 〔契約締結日〕

First party: 〔Controllerの名称〕 Signature: ____________________

Second party: 〔Processorの名称〕 Signature: ____________________