Exhibit B: Data Processing Addendum
Pursuant to the {{name_of_agreement}} dated {{date_of_agreement}} (“Agreement”) between NortonLifeLock Inc. andits affiliates (“NortonLifeLock”), and {{third_party}} (“Partner”) (each a “Party”; collectively the “Parties”), the Parties
hereby adopt this Data Processing Addendum (“Addendum”), which will remain in effect for so long as NortonLifeLock
maintains Personal Information (as defined below) pursuant to the Agreement. This Addendum prevails over any
conflicting terms of the Agreement.
1.

Definitions. For the purposes of this Addendum-1.1.
“Data Protection Legislation” shall mean: (i) the Personal Information Protection and ElectronicDocuments Act, SC 2000, c 5 (“PIPEDA”) or (ii) provincial legislation which applies within a provinceand has been deemed substantially similar to PIPEDA, including British Columbia’s Personal
Information Protection Act, Alberta’s Personal Information Protection Act, and Québec’s An Act
Respecting the Protection of Personal Information in the Private Sector.
1.2.
“Services” means the services or products provided pursuant to the Agreement.

2.

Roles and Scope.
2.1.
This Addendum applies only to the collection, retention, use, processing, and disclosure of PersonalInformation (as defined below) in the course of NortonLifeLock providing Services to Partner pursuant
to the Agreement. Without restricting the generality of the foregoing, each Party shall only process
Personal Information for the specific purpose(s) set out in the Agreement, where such Party has
obtained the Employee’s (as defined below) prior consent, and/or as may otherwise be required bylaw. “Personal Information” shall mean any identifiable information of Partner employees (each an“Employee”) that Partner transfers to NortonLifeLock for purposes of enrolling Partner employees.
2.2.
The Parties acknowledge and agree that each: (i) is an independent data controller; (ii) subject to theterms of this Addendum, will individually determine the purposes and means of its collection;
retention, use, processing, or disclosure of Personal Information; and (iii) will comply with its
obligations under applicable Data Protection Legislation. In the event that the Services involve
Personal Information collected outside of Canada, the Parties will enter into an appropriate dataprocessing addendum for such regions. Neither Party will process Personal Information outside of
the United States or Canada.

3.

Restrictions on Processing.
3.1.
Except as otherwise permitted by applicable law, each Party is prohibited from: (i) selling PersonalInformation; (ii) retaining, using, or disclosing Personal Information for any purpose other than for thespecific purpose of performing the Services specified in the Agreement, including retaining, using, ordisclosing Personal Information for a Commercial Purpose other than providing the Services
specified in the Agreement; and (iii) retaining, using, or disclosing Personal Information to any third
party and/or outside of the direct business relationship between NortonLifeLock and Partner.

4.

Security.
4.1.
Each Party hereby represents and warrants that it shall implement and maintain no less thanreasonable security procedures and practices, appropriate to the nature of the information, to protect
Personal Information from unauthorized access, destruction, use, modification, or disclosure(“Security Incident”) and to preserve the security and confidentiality of Personal Information inaccordance with applicable Data Protection Legislation.
4.2.
Each Party will notify the other Party as soon as possible of any potential or actual loss of Personal
Information and/or any breach of the technical and/or organizational measures taken, but, in any
event, within 48 hours after identifying any potential or actual loss and/or breach.
4.3.
Parties will take appropriate measures to address any Security Incident, and provide each other withreasonable assistance as required to facilitate the handling of any Security Incident.
4.4.
Each Party shall ensure that persons authorized to process Personal Information are bound tomaintain the confidentiality of such information.

5.

Data Subject Rights.
5.1.
The Parties are, in their roles as separate data controllers, individually responsible for fulfilling therights of Employees regarding the processing of Personal Information transferred under thisAddendum.

6.

Personal Information Quality.
6.1.
Each Party shall ensure that any Personal Information it shares with the other Party is accurate andkept up to date, and shall take reasonable steps to ensure that Personal Information that is6.2.

inaccurate is erased or rectified without delay.
Each Party will notify the other Party without undue delay if such Party becomes aware of
inaccuracies in any Personal Information such Party has shared with the other Party, or that any such
Personal Information has become outdated.

7.

Sale of Information.
7.1.
The Parties acknowledge and agree that the exchange of Personal Information between the Parties
does not form part of any monetary or other valuable consideration exchanged between the Parties
with respect to the Agreement or this Addendum.

8.

Personal Information Retention; Documentation
8.1.
Parties shall not retain or process Personal Information for longer than is necessary to carry out theirrespective obligations as set out in the Agreement and this Addendum.
8.2.
Notwithstanding Section 9.1 above, the Parties shall only retain Personal Information in accordancewith applicable law, and/or in accordance with that Party’s data retention schedule.
8.3.
Each Party shall be able to demonstrate compliance with its obligations under this Addendum,including without limitation by keeping appropriate documentation of any processing activities carriedout under such Party’s responsibility.

9.

Certification.
9.1.
Partner hereby certifies that Partner understands the restrictions and requirements in this Addendum
and will comply with them.

NortonLifeLock Inc.

Partner

Name:

Name:

Title:

Title:

Address:

Address:

Signature:

Signature:

Date:

Date: