e-TafaknaThis clause allocates roles between the party that decides on the processing (the controller) and the one that processes data on its behalf (the processor). It sets security, confidentiality, breach notification and data return obligations. Without it, a company that outsources payroll, hosting or marketing remains exposed to sanctions for its provider's failings.
Create a free account1. For the purposes of this contract, [CLIENT] acts as controller and [PROVIDER] as processor of the personal data listed in [ANNEX]. 2. The Provider shall process the data only on the Client's documented instructions and solely for the performance of the contract. 3. The Provider shall implement appropriate technical and organisational measures to ensure the security and confidentiality of the data, and shall bind its staff to confidentiality. 4. The Provider shall not engage another processor or transfer data outside [COUNTRY] without the Client's prior written authorisation and compliance with applicable law. 5. The Provider shall notify the Client of any personal data breach within [48] hours of becoming aware of it and shall assist the Client in responding to requests from data subjects and the authorities. 6. At the end of the contract, the Provider shall, at the Client's choice, return or delete the data and certify that it has done so. 7. Each party shall comply with the personal data protection legislation applicable to it.
Replace the bracketed items before use.
Each party acts as an independent controller of the personal data it collects and processes in connection with this contract. Each party is responsible for its own compliance, in particular for informing data subjects, the lawful basis of processing, security and any filings with the competent authority. The parties shall share only the data strictly necessary for the performance of the contract.
TunisiaOrganic Law No. 2004-63 makes processing subject to prior declaration to the national personal data protection authority (INPDP) and, as a rule, to the express and written consent of the data subject. Any transfer abroad requires the authority's authorisation.
Source: Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data
United Arab EmiratesFederal Decree-Law No. 45 of 2021 requires a contract between controller and processor and regulates transfers abroad, which are permitted mainly to countries offering an adequate level of protection. It does not apply to free zones with their own data protection law, such as the DIFC and ADGM.
Source: Clyde & Co, UAE issues landmark personal data protection law
Saudi ArabiaThe Personal Data Protection Law, issued by Royal Decree M/19, has been fully enforceable since 14 September 2024 and is supervised by SDAIA. Transfers outside the Kingdom require an adequate country or safeguards such as standard contractual clauses.
Source: Morgan Lewis, Saudi Arabia PDPL: transition period ends 14 September
FranceUnder the GDPR, the contract with a processor must set out documented instructions, security, assistance and breach notification, and the processor needs the controller's authorisation before using a sub-processor.
Source: CNIL, Travailler avec un sous-traitantWhen a provider processes personal data on behalf of its client, several laws, including the GDPR and the UAE law, require a written contract setting out its obligations. Even where it is not mandatory, the clause protects the client against its provider's mistakes.
Indicative template, to adapt to your situation. It does not replace legal advice.
Generate the contract for your country, add your clauses and sign online, all in one place.