 CLÁUSULAS  CONTRACTUALES MODELO

PARA LA TRANSFERENCIA
INTERNACIONAL DE DATOS

Anexo

1. Model agreement for the international transfer of Personal Data
from Controller to Controller

2. Model agreement for the international transfer of Personal Data
from Controllers and Processors

Pag. 3

Pag. 26

Content

NOTE: The use of these model contractual clauses requires prior reading the respective Explanatory Guide in

order to identify their suggested use and the scope of the document. It is the sole responsibility of the person who

processes Personal Data to demonstrate compliance with the respective regulatory requirements or to turn to the

competent Supervisory Authority/ies to confirm their proper use.

MODEL AGREEMENT FOR THE INTERNATIONAL
TRANSFER OF PERSONAL DATA
FROM CONTROLLER TO CONTROLLER

1.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

4

Data Importer

Data Exporter

Full Name:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Data Exporter’s name]

Address:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Data Exporter’s address]

Contact details:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Data Exporter’s contact details]

Governing law:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Current data protection law of the country of the Data Exporter]

Competent Supervisory Authority:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Data protection authority of the country of the Data Exporter]

Full name:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Data Importer’s name]

Address:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Data Importer’s address]

Contact details:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[Data Importer’s contact details]

Signature Date: Signed in [City, Country], on [MM/DD/YYYY],

Data Exporter’s Signature: ............................................................................

Data Importer’s Signature: ............................................................................

The Contracting Parties have concluded this Agreement based on model contractual clauses
(hereinafter “model contractual clauses” or the “Agreement”).

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

5

MODEL AGREEMENT FOR THE INTERNATIONAL
TRANSFER OF PERSONAL DATA
FROM CONTROLLERS TO CONTROLLERS

1.

Las Partes del Contrato han acordado el presente Acuerdo basado en cláusulas con-
tractuales modelo:

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

6

The Contracting Parties have concluded this Agreement based on model contractual clauses:

FIRST PART:
GENERAL PROVISIONS

Clause 1.
Purpose, parties, scope of application, and definitions

1.1. Purpose

a. The purpose of these model contractual clauses is to ensure and facilitate compliance with the require-

ments for the international transfer of Personal Data set by the Governing Law, in order to comply with the

principles and obligations for the protection of Personal Data and the rights of Data Subjects.

b. Any interpretation of this Agreement shall take these purposes into account.

1.2. Contracting parties

a. The Contracting Parties are the Data Exporter and the Data Importer.

b. This Agreement allows the incorporation of additional importers or exporters as Contracting Parties using the

form in Annex A and following the procedure established in Clause 5.

1.3. Scope of application

a. This Agreement shall apply to international transfers of Personal Data between Data Exporters and Data

Importers, in accordance with the specifications in Annex B.

b. The annexes form an integral part of this Agreement.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

7

Agreement:
this contract for the international transfer of Perso-
nal Data based on model contractual clauses together
with its title page and its annexes.

Anonymization:
the application of measures of any kind aimed at pre-
venting the identification or re-identification of an in-
dividual without disproportionate efforts.

Competent Supervisory Authority:
Personal data protection authority in the country of
the Data Exporter or Data Importer.

Cloud Computing:
model for enabling access to a set of IT services (such
as networks, servers, storage, applications, and ser-
vices) in a convenient manner and on demand, which
can be rapidly provided and released with adminis-
trative efforts and based on the interaction with the
service provider.

Consent:
expression of the free, specific, unequivocal and in-
formed will of the Data Subject through which he/she
accepts and authorizes the processing of his/her Per-
sonal Data.

Personal Data:
any information regarding an identified or identifia-
ble individual, expressed in a numerical, alphabetical,
graphical, photographic, alpha-numeric, or acoustic
way, or in any other form. It is considered that a per-
son is identifiable when his/her identity can be deter-
mined directly or indirectly, provided that this does not
require disproportionate time or efforts.

Sensitive Personal Data:
Personal Data that refer to the intimate sphere of the
Data Subject, the undue use of which may result in
discrimination or create a serious risk thereof. In an
illustrative way, Personal Data that may reveal aspects
such as racial or ethnic origin; beliefs or religious, phi-
losophical and moral convictions; trade union mem-
bership; political opinions; information regarding
health, sexual life, preference or orientation; genetic
data; or biometric data aimed at identifying a natural
person in an unequivocal manner will be considered
as sensitive.

Automated Individual Decisions:
decisions that produce legal effects concerning the
Data Subject, or that affect him/her in a significant
way, based solely on automated processing intended
to assess, without human intervention, specific per-
sonal aspects, or to analyze or predict, specifically,
his/her professional performance, economic situation,
health status, sexual preferences, reliability or beha-
vior.

Processor:
service provider who, as a natural or legal person or
public authority, outside the organization of the Con-
troller, processes Personal Data in the name and on
behalf of the Controller.

Standards:
Standards for Personal Data Protection for the Ibe-
ro-American States approved by the RIPD in 2017.

1.4. Definitions

a. The defined terms are identified in this Agreement by their capital letters.

b.  For the purposes of this Agreement, the following terms shall be defined:

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

8

Data Exporter:
natural person or private legal entity, public authority,
service, body or service provider, located in the terri-
tory of a State, which performs international transfers
of Personal Data, according to the provisions of the
Standards.

Data Importer:
natural person or private legal entity, public authori-
ty, service, body or service provider located in a third
country, that receives Personal Data from a Data Ex-
porter through an international transfer of Personal
Data.

Governing Law:
the Personal Data protection law of the Data Expor-
ter’s jurisdiction.

Administrative, Physical,
and Technical Measures:
measures aimed at preventing any damage, loss, alte-
ration, destruction, access to, and in general any illicit
or unauthorized use of Personal Data, even if acci-
dental, sufficient to ensure the confidentiality, integrity
and availability of the Personal Data.

Controller:
natural person or private legal entity, public authority,
service or body that, alone or together with others,
determines the purposes, means, scope and other
matters related to the Processing of Personal Data.

Sub-processor:
another Processor relied on by the Processor to ca-
rry out certain Processing activities on behalf of the
Controller.

Third-Party Beneficiaries:
Data Subject whose Personal Data is subject to an in-
ternational transfer under this Agreement. The Data
Subject is a Third-Party Beneficiary of the rights pro-
vided in his/her favor in the MCCs, and can therefore
exercise the rights granted to it by the MCCs, even if
he/she has not joined the model contract between the
Parties.

Data Subject:
natural person to whom the Personal Data relates.

Onward Transfer:
transfer of data by the Data Importer to a third party
located outside of the jurisdiction of the Data Exporter
that complies with the safeguards set out in the MCCs.

Processing:
any operation or set of operations performed on Per-
sonal Data through physical or automated procedu-
res related, but not limited, to the collection, access,
registration, organization, structuring, adaptation, in-
dexation, modification, extraction, consultation, stora-
ge, conservation, elaboration, transfer, dissemination,
possession, exploitation, and in general, any use or
disposal of Personal Data.

Personal Data Breach:
any damage, loss, alteration, destruction, access, and
in general any illicit or unauthorized use of Personal
Data, even if accidental.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

9

Clause 2.
Effects and invariability of the clauses

2.1. Modification of the model contractual clauses. Limitations

This Agreement based on model contractual clauses establishes adequate safeguards for Data Subjects pertai-

ning to the transfer of their data, from Controller(s) to Controller(s), provided that the clauses are not modified

in their essence compared to the original model, except to complete the title page and the annexes. This does

not prevent the Parties from including model contractual clauses in a broader contract, nor does it prevent

them from adding further clauses or safeguards, provided they do not directly or indirectly contradict these

model contractual clauses or affect the rights of Data Subjects.

2.2. Hierarchy with the governing law. Interpretation

a. This Agreement shall be read and interpreted in accordance with the provisions of the Governing Law.

b. The Parties may add new definitions and further safeguards to these model contractual clauses when ne-

cessary to comply with the Governing Law and provided this does not negatively affect the protections granted

by the model contractual clauses.

c. This Agreement shall not be interpreted in a manner that conflicts with the rights and obligations set out in

the Governing Law.

d. This Agreement is understood to be without prejudice to the obligations to which the Data Exporter is sub-

ject by virtue of its legislation or the Governing Law.

2.3. Hierarchy with other agreements

In case of a contradiction between this Agreement and the provisions of related agreements between the Par-

ties, the clauses of this Agreement shall prevail.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

10

Clause 3.
Third-party beneficiaries

Clause 4.

Clause 5.

 Description of the transfer(s) and the purpose(s) thereof

Docking clause

Data Subjects may invoke, as Third-Party Beneficiaries, the clauses of this Agreement against the Data Exporter and/

or the Data Importer and require them to ensure compliance.

The details and characteristics of the transfer or transfers and, particularly, the categories of the Personal Data

transferred and the purposes for which they are transferred are specified in Annex B of this Agreement.

a. The Parties accept that any entity that is not a party to this Agreement may, with the prior consent of all

Parties involved, adhere to this Agreement at any time, either as a Data Exporter or as a Data Importer, by

signing the form in Annex A, and completing the other Annexes, if applicable.

.

b. Once it has signed Annex A and completed the other annexes, if applicable, the joining entity shall be

considered a Party to this Agreement and shall have the rights and obligations of a Data Exporter or a Data

Importer, depending on the role under which it has adhered to the Agreement, as indicated in Annex A.

c. The entity joining the Agreement shall not acquire rights and obligations under this Agreement for the

period prior to its adhesion.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

11

SECOND II:
OBLIGATIONS OF THE PARTIES

Clause 6.
Data protection safeguards

a. The Data Exporter warrants that it has used reasonable efforts to determine that the Data Importer is able

to perform its obligations under this Agreement by applying appropriate Administrative, Physical and Technical

Measures.

b. The Data Importer shall implement the necessary mechanisms to demonstrate compliance with the princi-

ples and obligations established in this Agreement, thereby ensuring accountability to the Data Subject and the

Competent Supervisory Authority for the Processing of the Personal Data in its possession.

c. The Data Importer shall review and permanently assess the mechanisms that it voluntarily adopts to com-

ply with the principle of accountability, in order to measure their level of effectiveness in complying with this

Agreement.

6.1. Principle of accountability

6.2. Principle of purpose limitation

a. The Data Importer shall not process the Personal Data subject to this Agreement for purposes other than

those set out in Annex B.

b. It may only process Personal Data for other purposes: (i) with the prior consent of the Data Subject; (ii)

when necessary for the establishment, exercise, or defense of legal claims within the framework of specific

administrative, regulatory, or judicial procedures; (iii) when the Processing is necessary to protect the vital

interests of the Data Subject or of another natural person.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

12

a. For Data Subjects to effectively exercise the rights granted to them by this Agreement, the Data Importer

shall inform them of the following, either directly or through the Data Exporter: (i) its identity and contact de-

tails; (ii) the categories of Personal Data processed and their purposes; (iii) the right to request a copy of this

Agreement free of charge; (iv) when it intends to carry out onward transfers of Personal Data to third parties, the

recipient or categories of recipients and the purpose of such onward transfers.

b. This shall not apply when the Data Subject already has the information, or when it is impossible to commu-

nicate such information or if it requires disproportionate efforts from the Data Importer.

c. Where a copy of the Agreement is requested, the Parties may redact the sections or annexes of the Agree-

ment that contain trade secrets or other types of confidential information, such as Personal Data of third parties

or confidential information related to the contractual obligations between the Parties.

6.3. Transparency

a. The Data Importer shall retain the Personal Data for no longer than necessary for the purposes for which it

is processed.

b. The Data Importer shall put in place appropriate Administrative, Physical, and Technical Measures to ensu-

re compliance with this obligation, including the deletion or anonymization of the data and all back-ups at the

end of the retention period.

6.4. Data accuracy and minimization

6.5. Storage limitation

a. The Parties shall ensure that the Personal Data is accurate and, where necessary, kept up to date. The Data

Importer shall take all reasonable steps to promptly delete or rectify any Personal Data that is inaccurate for the

purposes for which it is being processed.

b. If either Party becomes aware that the Personal Data transferred or received is inaccurate or outdated, it

shall inform the other Party without undue delay.

c. The Data Importer shall ensure that the Personal Data is adequate, relevant, and limited to what is necessary

in relation to the purposes for which it is being processed.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

13

6.6. Principle of data security

a. The Data Importer and, during the transfer, also the Data Exporter, shall implement and maintain appropria-

te Administrative, Physical and Technical Measures to ensure the confidentiality, integrity, and availability of the

Personal Data subject to this Agreement.

To determine the security measures, the Data Importer shall consider the following factors:

i) the risk to the rights and freedoms of the Data Subjects, particularly due to the potential quantitative and

qualitative value that the processed Personal Data could represent for a third party that is not authorized to

possess it;

ii) the state of the art;

iii) the costs of implementation;

iv) the nature of the processed Personal Data, especially if it is Sensitive Personal Data;

v) the scope, context, and purposes of the Processing;

vi) the potential consequences of a Personal Data Breach for the Data Subjects;

vii) previous Personal Data Breaches that occurred in the Processing of the Personal Data.

b. The Parties have agreed to the Administrative, Physical and Technical Measures listed in Annex C to this

Agreement for the Personal Data that are the subject of the international transfer.

c. The Data Importer shall carry out regular checks to ensure that these measures continue to provide an ade-

quate level of security.

Personal data breach

a. In the event of a Personal Data Breach of Personal Data processed by the Data Importer under this Agree-

ment, the Data Importer shall take appropriate steps to address the breach and to mitigate any potential negative

effects.

b. The Data Importer shall document all relevant facts related to the Personal Data Breach, such as its effects

and the corrective measures taken, and keep a record thereof.

c. Whenever one of the Parties becomes aware of a Personal Data Breach, it shall notify the other Party, the

Competent Supervisory Authority, and the affected Data Subjects thereof, without any delay and at the latest

within a period of not more than five (5) days.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

14

d.   The notification set out in the previous paragraph shall be drafted in clear and simple language. Said notifi-

cation shall at least contain the following information:

e.   To the extent the Data Importer is unable to provide all information at once, it may do so in phases without

further undue delay.

f. Data Subjects do not have to be notified when said notification involves disproportionate efforts. In this

case, the Data Importer shall issue a public communication or take similar measures to inform the public of the

Personal Data Breach.

a. The Data Importer shall ensure that any person acting under its authority processes the data in accordance

with the instructions given by the Data Importer, and shall establish controls or mechanisms for those intervening

in any phase of the Processing of the Personal Data to maintain and respect the confidentiality thereof, which is an

obligation that shall continue to apply even after the end of its contractual relationship with the Data Exporter.

b. The Data Importer shall ensure that the persons authorized to process the Personal Data have agreed to

respect the principle of confidentiality or are subject to a legal confidentiality obligation.

a. Where the transfer involves Sensitive Personal Data, the Data Importer shall apply specific restrictions and

additional safeguards adapted to the specific nature of the data and the risk involved.

b.   These measures may consist of, for example, restricting the personnel permitted to access the Personal

Data, special confidentiality agreements, additional security measures (such as Anonymization), and/or additio-

nal restrictions related to Onward Transfers.

c. Where the transfer involves Personal Data concerning children or adolescents, the Parties shall privilege

the protection of their superior interests, in accordance with the Convention on the Rights of the Child and other

international instruments.

i) the nature of the incident;

ii) the affected Personal Data;

iii) the corrective measures immediately adopted;

iv) in the event of notification to the Data Subject, recommendations on the measures to be adopted by

the latter to protect his/her interests;

v) the means available to the Data Subject to obtain more information

6.7. Processing under the authority of the data importer
       and principle of confidentiality

6.8. Processing of sensitive personal data

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

15

6.9. Onward Transfers

6.10. Documentation and compliance

a.  The Data Importer may only disclose the Personal Data to third parties located outside the Data Exporter’s

jurisdiction if the third party is or agrees to be bound by this Agreement. Otherwise, the Data Importer may only

carry out an Onward Transfer in the following cases:

(i) in case this is provided for by the Governing Law, the Onward Transfer is to a country that has been the

subject of an adequacy decision regarding its level of protection of Personal Data in accordance with the

provisions of the Governing Law, provided that such decision covers the Onward Transfer;

(ii) the third party recipient of the Onward Transfer otherwise provides adequate safeguards, in accordance

with the Governing law, with regard to Personal Data subject to the Onward Transfer;

(iii) the third party enters into a binding instrument with the Data Importer that ensures the same level of

data protection as under this Agreement, and the Data Importer provides a copy of these safeguards to the

Data Exporter;

(iv) the Onward Transfer is necessary for the establishment, exercise, or defense of legal claims in the con-

text of specific administrative, regulatory or judicial proceedings;

(v) if it is necessary to protect the vital interests of the Data Subject or of another natural person; or

(vi) where none of the other conditions applies, the Data Importer has obtained the explicit Consent of the

Data Subject for an Onward Transfer in a specific situation, after having informed him/her of the purpose,

the identity of the recipient, and the possible risks of such transfer to the Data Subject due to the lack of

appropriate data protection safeguards. In this case, the Data Importer shall inform the Data Exporter and,

at the request of the latter, shall transmit to it a copy of the information provided to the Data Subject.

b. All Onward Transfers shall be subject to compliance by the Data Importer with the other safeguards provided

in this Agreement and, in particular, compliance with the principle of purpose limitation.

a.   Each Party shall be able to demonstrate compliance with its obligations under this Agreement.

b. In particular, the Data Importer shall keep appropriate documentation of the processing activities carried

out under its responsibility, which shall be made available upon request to the Data Exporter and, where appro-

priate, the Competent Supervisory Authority.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

16

a. The Data Importer, where relevant with the assistance of the Data Exporter, shall deal with any enquiries and

requests from a Data Subject relating to the Processing of their Personal Data and the exercise of their rights

under this Agreement. It shall do so free of charge and without undue delay, and at the latest within a period of

fifteen business days of their receipt, unless the applicable law indicates a shorter time,

b. The Data Importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of

rights of Data Subjects. Any information provided to Data Subjects shall be in an intelligible and easily accessible

form, using clear and plain language.

c. In particular, Data Subjects shall have the right:

(i) to request confirmation on the processing of their Personal Data, to access their Personal Data in the

possession of the Data Importer, including to obtain a complete copy thereof, as well as to be informed

about the general and specific conditions of the Processing, including information about the categories of

Personal Data processed, the purpose of the Processing, the retention period (or the criteria to determine it),

the existence of any Onward Transfers, including the recipients and the purposes thereof, and information

about the right to file a complaint with the Competent Supervisory Authority;

(ii) to request the Data Importer to rectify or correct any inaccurate, incomplete or outdated Personal Data;

(iii) to request the destruction or deletion of their Personal Data from the Data Importer’s files, records and

systems, so that they are no longer in its possession and cease to be processed, when the data is processed

in violation of their Third-Party Beneficiaries rights arising from this Agreement, or when the Data Subject

withdraws his/her consent to the Processing;

(iv) to object to the Processing of their Personal Data for direct marketing purposes, including profiling, to

the extent that it is related to such activity.

(v) to request and access the Agreement entered into between the Data Importer and the Data Exporter,

following redaction of any confidential information related to third parties  and to the extent this is in line

with the rules applicable to the Data Importer.

Clause 7.
Rights of data subjects

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

17

7.1 Limitations on the exercise of the rights of the data subject

a.   The Data Importer may refuse a Data Subject’s request where permitted under the laws of the country of

destination and when necessary and proportionate in a democratic society to protect important objectives of

general public interest or the rights and freedoms of individuals.

b. If the Data Importer intends to refuse a Data Subject’s request, it shall inform him/her of the reasons for

the refusal and of the possibility of lodging a complaint with the Competent Supervisory Authority or of seeking

judicial redress.

.

7.2 Right not to be subject to automated individual decisions

a. The Data Importer shall not make any Automated Individual Decision with respect to the transferred Personal

Data.

b. The prohibition according to the preceding paragraph shall not apply when (i) the Automated Individual

Decision is authorized by the laws of the Data Importer’s country, which ensures appropriate safeguards for the

rights of Data Subjects, or (ii) the Automated Individual Decision is based on the Data Subject’s explicit consent.

c. When the data processing is authorized by law or the Data Subject has given his/her consent, the Data Sub-

ject shall have the right to (i) receive an explanation about the decision made; (ii) be heard and express his/her

point of view and challenge the decision, and (iii) obtain a human intervention.

d. The Controller may not carry out automated Personal Data Processing that leads to discrimination against

Data Subjects due to their racial or ethnic origins; religious, philosophical, and moral beliefs or convictions; trade

union membership; political opinions; sexual life, preference or orientation; or the Processing of health, genetic

or biometric data.

Clause 8.
Redress

a. The Data Importer shall inform the Data Subjects, in a transparent and easily accessible format, through

individual notice or on its website, of a contact point authorized to handle complaints, which shall handle com-

plaints received from the Data Subjects as quickly as possible [OPTION: The Data Importer agrees that Data

Subjects may also lodge a complaint with an independent dispute resolution body at no cost. The Data Importer

shall inform the Data Subjects of this redress mechanism, in the manner established in this paragraph, and that

they are not required to use this mechanism or follow a particular sequence in seeking redress.]

Clause 9.

Clause 10.

Civil liability

Supervision by the competent supervisory authority

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

18

b.   In case of a dispute between a Data Subject and one of the Parties as regards compliance with this Agree-
ment, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep
each other informed about such disputes and, where appropriate, collaborate in good faith in resolving them.

c. Whenever a Data Subject invokes a Third-Party Beneficiary Right under this Agreement, the Data Importer
undertakes to accept and not dispute the Data Subject’s decision to: (i) lodge a complaint with the Supervisory
Authority in its country of habitual residence or place of work, or with the Competent Supervisory Authority; (ii)
bring legal proceedings regarding their Personal Data in accordance with the provisions of Clause 14 of this
Agreement.

d. The Data Importer agrees to abide by decisions that are binding under the Governing Law or other applicable law.

a. Each Party shall be liable to the other Party for any damage caused by any breach of the rights and obliga-

tions set out in this Agreement.

b. Each Party shall be liable to the Data Subject. The Data Subject shall be entitled to receive compensation for

any material or non-material damages caused by any of the Parties for violating the Third-Party Beneficiary Rights

under this Agreement. This is without prejudice to the liability of the Data Exporter under the Governing Law.

c. Where more than one Party is responsible for any damage or loss caused to the Data Subject as a result of

a breach of this Agreement, all responsible Parties shall be jointly and severally liable.

d. The Parties agree that if one Party is held liable under the previous paragraph, it shall be entitled to claim

back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the da-

mage or loss caused.

a. The Data Importer agrees to submit itself to the jurisdiction of and cooperate with the Competent Supervi-

sory Authority in any procedures aimed at ensuring compliance with this Agreement.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

19

Clause 11.
Local laws and practices affecting
compliance with the clauses

b. In particular, the Data Importer agrees to respond to enquiries, submit to audits and comply with the measu-

res adopted by the Supervisory Authority, especially the remedial and compensatory measures. It shall provide

the Supervisory Authority with a written confirmation that the necessary measures have been taken.

c. Similarly, the Data Importer agrees to submit itself to the powers of the Competent Supervisory Authority in

relation to the suspension of transfers, the suspension of contracts, and any other measures that the Supervisory

Authority may require.

a. The Parties confirm that, at the time of entering into this Agreement, they have used reasonable efforts to

identify whether the transferred data is covered by any local law or practice in the Data Importer’s jurisdiction

that goes beyond what is necessary and proportionate in a democratic society to safeguard important public

interest objectives, and that may reasonably be expected to affect the protections, rights, and safeguards

afforded to Data Subjects under this Agreement. Based on the foregoing, the Parties confirm that they are not

aware of the existence of any practice or norm that could adversely affect the specific safeguards under this

Agreement.

b. The Data Importer agrees to notify immediately the Data Exporter if any such laws become applicable to it

in the future. If such notification is made, or if the Data Exporter has a reason to believe that the Data Importer

is no longer able to perform its obligations under this Agreement, the Data Exporter shall identify appropriate

measures to address the situation (for example, Administrative, Physical and Technical Measures to ensure the

security of the data).

c. Similarly, the Data Exporter may suspend transfers under this Agreement if it considers that adequate sa-

feguards cannot be ensured. In this case, the Data Exporter shall have the right to terminate this Agreement in

accordance with the conditions set out in Clause 12.

d. If a court or government agency requires the Data Importer to disclose or use the transferred data in a man-

ner not otherwise permitted by this Agreement, the Data Importer shall assess the legality of such request and

challenge it if, following a careful legal assessment, it concludes that there are reasonable grounds to believe

that the request is illegal under local law and affects the rights ensured by this Agreement. Where permitted by

local law, it shall also promptly notify the Data Exporter that it has received such  request. If the Data Importer is

prohibited by local law from notifying the Data Exporter, the Data Importer shall use reasonable efforts to obtain

a waiver of such prohibition.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

20

a. The Data Importer shall immediately notify the Data Exporter if it is unable to comply with any provision of

this Agreement, for whatever reason.

b. In the event that the Data Importer fails to comply with its obligations under this Agreement, the Data Ex-

porter shall suspend the transfer of Personal Data to the Data Importer until compliance is again ensured or the

contract is terminated.

c. The Data Exporter shall be entitled to terminate this Agreement when:

(i) the Data Exporter has suspended the transfer of Personal Data to the Data Importer pursuant to the pre-

vious paragraph and compliance with this Agreement is not restored within a reasonable period of time and in

any event within thirty (30) business days from the suspension;

(ii) the Data Importer is in substantial or persistent breach of this Agreement; or

(iii) the Data Importer fails to comply with a binding decision of a competent court or Supervisory Authority

regarding its obligations under this Agreement. In this case, it shall inform the competent Supervisory Authority

of its non-compliance.

d. Personal Data that has been transferred prior to the termination of the contract pursuant to the previous

paragraph shall, at the choice of the Data Exporter, immediately be returned to the Data Exporter or deleted in its

entirety. The same shall apply to any copies of the data. The Data Importer shall certify the deletion of the data

to the Data Exporter. Until the data is deleted or returned, the Data Importer shall continue to ensure compliance

with this Agreement. In case of local laws applicable to the Data Importer that prohibit the return or deletion of

the transferred Personal Data, the Data Importer warrants that it will continue to ensure compliance with this

Agreement and will only process the data to the extent and for as long as required under that local law.

Clause 12.
Non-compliance with the clauses and termination

SECTION III:
FINAL PROVISIONS

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

21

Clause 13.
Governing law

This Agreement shall be governed by the Governing Law.

a. Any dispute arising from this Agreement shall be resolved by the courts of the Data Exporter’s jurisdiction.

b. Data Subjects may also bring legal proceedings against the Data Exporter and/or the Data Importer, which

may be initiated, at the Data Subject’s choice, in the country of the Data Exporter or in which the Data Subject

has his/her habitual residence. With respect to the Data Importer, s/he may also file legal proceedings in the

country of the Data Importer.

c. The Parties agree to submit to the competent court(s) provided for in this clause.

Clause 14.
Choice of forum and jurisdiction

ANNEX A
ACCESSION FORM FOR NEW PARTIES

ANNEX B
DESCRIPTION OF THE TRANSFER

ANNEX C
ADMINISTRATIVE, PHYSICAL AND TECHNICAL MEASURES
TO ENSURE DATA SECURITY

ANNEX D
ADDITIONAL LEGAL DOCUMENTATION

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

22

ANNEXES

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

23

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

24

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO CONTROLLER

25

MODEL AGREEMENT FOR THE INTERNATIONAL
TRANSFER OF PERSONAL DATA
CONTROLLERS AND PROCESSORS

2.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

27

The Contracting Parties have concluded this Agreement based on model contractual clauses:

FIRST PART:
GENERAL PROVISIONS

Clause 1.
Purpose, parties, scope of application and definitions

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

28

1.1. Purpose

a. The purpose of these model contractual clauses is to ensure and facilitate compliance with the require-

ments for the international transfer of Personal Data set by the Governing Law, in order to comply with the

principles and obligations on the protection of Personal Data

b. Any interpretation of this Agreement shall take these purposes into account.

1.2. Contracting parties

a. The Contracting Parties are the Data Exporter and the Data Importer

b This Agreement allows the incorporation of additional importers or exporters as Contracting Parties, using

the form in Annex A following the procedure established in Clause 5.

1.3. Scope of application

This Agreement shall apply to international transfers of Personal Data between Data Exporters and Data Importers,

in accordance with the specifications of Annex B. The annexes form an integral part of this Agreement.

1.4. Definitions

The defined terms are identified in this Agreement by capital letters. For the purposes of this Agreement, the fo-

llowing terms shall be defined:

Agreement:
this contract for the international transfer of Perso-
nal Data based on model contractual clauses together
with its title page and its annexes.

Anonymization:
the application of measures of any kind aimed at pre-
venting the identification or re-identification of an in-
dividual without disproportionate efforts.

Competent Supervisory Authority:
personal data protection authority in the country of
the Data Exporter or Data Importer.

Cloud Computing:
model for enabling access to a set of IT services (such
as networks, servers, storage, applications, and ser-
vices) in a convenient manner and on demand, which
can be rapidly provided and released with adminis-
trative efforts and based on the interaction with the
service provider.

Consent:
expression of the free, specific, unequivocal and in-
formed will of the Data Subject through which he/she
accepts and authorizes the Processing of his/her Per-
sonal Data.

Personal Data:
any information regarding an identified or identifia-
ble individual, expressed in a numerical, alphabetical,
graphical, photographic, alpha-numeric, oracoustic
way, or in any other form. It is considered that a per-
son is identifiable when his/her identity can be deter-
mined directly or indirectly, provided that this does not
require disproportionate time or efforts.

Sensitive Personal Data:
Personal Data that refer to the intimate sphere of the
Data Subject, the undue use of which may result in
discrimination or create a serious risk thereof. In an
illustrative way, Personal Data that may reveal aspects
such as racial or ethnic origin; beliefs or religious, phi-
losophical and moral convictions; trade union mem-
bership; political opinions; information regarding
health, sexual life, preference or orientation; genetic
data; or biometric data aimed at identifying a natural
person in an unequivocal manner will be considered
as sensitive.

Automated Individual Decisions:
decisions that produce legal effects concerning the
Data Subject, or that affect him/her in a significant
way, based solely on automated processing intended
to assess, without human intervention, specific per-
sonal aspects, or to analyze or predict, specifically,
his/her professional performance, economic situation,
health status, sexual preferences, reliability or beha-
vior.

Processor:
service provider who, as a natural or legal person or
public authority, outside the organization of the Con-
troller, processes Personal Data in the name and on
behalf of the Controller.

Standards:
Standards for Personal Data Protection for the Ibe-
ro-American States approved by the RIPD in 2017.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

29

Data Exporter:
natural person or private legal entity, public authority,
service, body or service provider, located in the terri-
tory of a State that performs international transfers
of Personal Data, according to the provisions of the
Standards.

Data Importer:
natural person or private legal entity, public authori-
ty, service, body or service provider located in a third
country that receives Personal Data from a Data Expor-
ter through an international transfer of Personal Data.

Governing Law:
the Personal Data protection law of the Data Expor-
ter’s jurisdiction.

Administrative, Physical and Technical
Measures:
measures aimed at preventing any damage, loss, al-
teration, destruction, access, and, in general, any illicit
or unauthorized use of Personal Data, even if acciden-
tal, sufficient to ensure the confidentiality, integrity and
availability of the Personal Data.

Controller:
natural person or private legal entity, public authority,
service or body that, alone or together with others,
determines the purposes, means, scope and other
matters related to the Processing of Personal Data.

Sub-processor:
another Processor relied on by the Processor to carry
out certain processing activities on behalf of the Con-
troller.

Third-Party Beneficiaries:
Data Subject whose Personal Data is subject to an in-
ternational transfer under this Agreement. The Data
Subject is a Third-Party Beneficiary of the rights pro-
vided in his/her favor in the MCCs and can therefore
exercise the rights granted to it by the MCCs, even if
s/he has not joined the model contract between the
Parties.

Data Subject:
natural person to whom the Personal Data relates.

Onward Transfer:
transfer of data by the Data Importer to a third party
located outside of the jurisdiction of the Data Exporter
that complies with the safeguards set out in the MCCs.

Processing:
any operation or set of operations performed on Per-
sonal Data through physical or automated procedu-
res, related, but not limited, to the collection, access,
registration, organization, structuring, adaptation, in-
dexation, modification, extraction, consultation, stora-
ge, conservation, elaboration, transfer, dissemination,
possession, exploitation, and in general any use or
disposal of Personal Data.

Personal Data Breach:
any damage, loss, alteration, destruction, access, and
in general any illicit or unauthorized use of Personal
Data, even if accidental.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

30

Clause 2.
Effects and invariability of the clauses

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

31

2.1. Modification of the model contractual clauses. Limitations

This Agreement based on model contractual clauses establishes adequate safeguards for Data Subjects pertai-

ning to the transfer of their data, from Controller(s) to Processor(s), provided that the clauses are not modified

in their essence compared to the original model, except to complete the title page and the annexes. This does

not prevent the Parties from including model contractual clauses in a broader contract, nor does it prevent

them from adding further clauses or safeguards, provided they do not directly or indirectly contradict these

model contractual clauses or affect the rights of Data Subjects.

2.2. Hierarchy with the governing law. Interpretation

a. This Agreement shall be read and interpreted in accordance with the provisions of the Governing Law.

b. The Parties may add new definitions and further safeguards to these model contractual clauses when ne-

cessary to comply with the Governing Law and provided this does not negatively affect the protections granted

by the model contractual clauses.

c. This Agreement shall not be interpreted in a manner that conflicts with the rights and obligations set out in

the Governing Law.

d. This Agreement is understood to be without prejudice to the obligations to which the Data Exporter is sub-

ject by virtue of its legislation or the Governing Law.

2.3. Hierarchy with other agreements

In case of a contradiction between this Agreement and the provisions of related agreements between the Par-

ties, the clauses of this Agreement shall prevail.

Clause 3.
Third-party beneficiaries

Clause 4.

Clause 5.

Description of the transfer(s) and the purpose(s) thereof

Docking clause

Data Subjects may invoke, as Third-Party Beneficiaries, the clauses of this Agreement against the Data Exporter and/

or the Data Importer and require them to ensure compliance.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

32

The details and characteristics of the transfer or transfers and, particularly, the categories of the Personal Data

transferred and the purposes for which they are transferred are specified in Annex B of this Agreement.

a. The Parties accept that any entity that is not a Party to this Agreement may, with the prior consent of all

Parties involved, adhere to this Agreement at any time, either as a Data Exporter or as a Data Importer, by signing

the form in Annex A, and completing the other Annexes, if applicable.

b. Once it has signed Annex A and completed the other annexes, if applicable, the joining entity shall be consi-

dered a Party to this Agreement and shall have the rights and obligations of a Data Exporter or a Data Importer,

depending on the role under which it has adhered to the Agreement, as indicated in Annex A.

c. The entity joining the Agreement shall not acquire rights and obligations under this Agreement for the period

prior to its adhesion.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

33

Clause 6.
Data protection safeguards

SECTION II:
OBLIGATIONS OF THE PARTIES

The Data Importer shall carry out Personal Data processing activities without any decision-making power over the

scope and content thereof, and instead limit its actions to the terms and instructions established by the Data Expor-

ter.

a. The Data Exporter warrants that it has used reasonable efforts to determine that the Data Importer is able

to perform its obligations under this Agreement by applying appropriate Administrative, Physical and Technical

Measures.

b. The Data Importer shall implement the necessary mechanisms to demonstrate compliance with the princi-

ples and obligations established in this Agreement, thereby ensuring accountability to the Data Subject and the

Competent Supervisory Authority for the Processing of the Personal Data in its possession.

c. The Data Importer shall review and permanently assess the mechanisms that it voluntarily adopts to comply

with the principle of accountability, in order to measure their level of effectiveness in complying with this Agree-

ment.

6.2. Principle of accountability

6.1. Instructions

6.3. Principle of purpose limitation

The Data Importer shall not process the Personal Data subject to this Agreement for purposes other than those set

out in Annex B, unless instructed otherwise by the Data Exporter.

6.4. Transparency

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

34

a. Upon request, the Parties shall make a copy of this Agreement available to the Data Subject free of charge.

In any case, the Data Importer shall proactively assume the responsibility to inform about its existence. The

sections or annexes of the Agreement containing trade secrets or other types of confidential information such

as Personal Data of third parties or confidential information related to the contractual obligations between the

Parties may be redacted.

b. This clause is without prejudice to the obligations imposed upon the Data Exporter by the Governing Law.

6.5. Data accuracy and minimization

6.6. Principle of data security

a. If the Data Importer becomes aware that the Personal Data it has received is inaccurate, or has become

outdated, it shall inform the Data Exporter without undue delay.

b. In this case, the Data Importer shall cooperate with the Data Exporter to erase or rectify the data.

a. The Data Importer and, during the transfer, also the Data Exporter, shall implement and maintain appropriate

Administrative, Physical and Technical Measures to ensure the confidentiality, integrity and availability of the

Personal Data subject to this Agreement, including protection against Personal Data Breaches. In assessing the

appropriate level of security, the parties shall duly consider the state of the art, the costs of implementation, the

nature, scope, context and purposes of the Processing, and the risks for the Data Subjects linked to the Proces-

sing. To comply with the obligations set out in this paragraph, the Data Importer shall implement, at least, the

Administrative, Physical and Technical Measures listed in Annex C to this Agreement. The Data Importer shall

carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

b. In the event of a breach of the Personal Data processed by the Data Importer under this Agreement, the Data

Importer shall take appropriate measures to address this breach, including measures to mitigate its adverse

effects.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

35

c. The Data Importer shall also notify the Data Exporter within seventy-two (72) hours of becoming aware of

the Personal Data Breach. Such notification shall include a description of the Personal Data Breach (including,

where possible, the categories of Personal Data and approximate number of Data Subjects affected), its likely

consequences, and the measures taken or proposed to address the breach and especially, where appropriate,

measures to mitigate its potential adverse effects.

d. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification

shall contain the information then available and further information shall, as it becomes available, subsequently

be provided without undue delay.

e. The Data Importer shall cooperate with and assist the Data Exporter in enabling it to comply with its obliga-

tions under the Governing Law, in particular to notify the Competent Supervisory Authority and the affected Data

Subjects, taking into account the nature of the Processing and the information available to the Data Importer.

a. The Data Importer shall ensure that the persons acting under its authority only process data in accordance

with its instructions and shall grant access to the Personal Data to members of its personnel only to the extent

strictly necessary for the implementation, management and monitoring of this Agreement.

b. The Data Importer shall ensure that the persons authorized to process the Personal Data maintain and

respect the confidentiality thereof, which is an obligation that shall continue to apply even after the end of its

contractual relationship with the Data Exporter.

6.7. Processing under the authority of the data importer
      and principle of confidentiality

6.8. Processing of sensitive personal data

a. Where the transfer involves Sensitive Personal Data, the Data Importer shall apply the specific restrictions

and/or additional safeguards described in Annex C to this Agreement.

b. Where the transfer involves Personal Data concerning children or adolescents, the Data Importer shall privi-

lege the protection of their superior interests, in accordance with the Convention on the Rights of the Child and

other international instruments.

6.9. Onward transfers

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

36

a. The Data Importer shall only disclose Personal Data to a third party on documented instructions from the

Data Exporter.

b. In addition, the Data Importer may only disclose the Personal Data to third parties located outside the Data

Exporter’s jurisdiction if the third party is bound by or agrees to be bound by this Agreement. Otherwise, the Data

Importer may only carry out an Onward Transfer in the following cases:

(i) in case this is provided for in the Governing Law, the Onward Transfer is to a country that has been the

subject of an adequacy decision regarding its level of protection of Personal Data in accordance with the

provisions of the Governing Law, provided that such decision covers the Onward Transfer;

(ii) the third party recipient of the Onward Transfer otherwise provides adequate safeguards, in accordance

with the Governing law, with regard to Personal Data subject to the Onward Transfer;

(iii) the Onward Transfer is necessary for the establishment, exercise or defense of legal claims in the

context of specific administrative, regulatory or judicial proceedings;

(iv) if it is necessary to protect the vital interests of the Data Subject or of another natural person.

c. All Onward Transfers shall be subject to compliance by the Data Importer with the other safeguards

provided in this Agreement and, in particular, compliance with the principle of purpose limitation.

a. The Parties shall be able to demonstrate compliance with their obligations under this Agreement. In parti-

cular, the Data Importer shall keep appropriate documentation of the processing activities carried out under the

instructions of the Data Exporter, which shall be made available to the Data Exporter and the Competent Super-

visory Authority upon request.

b. The Data Importer shall promptly and in an appropriate manner deal with the Data Exporter’s enquiries that

relate to the Processing under this Agreement.

6.10. Documentation and compliance

6.11. Duration of the data processing and deletion or return of the data

Clause 7.
Reliance on sub-processors

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

37

c. The Data Importer shall make available to the Data Exporter all information necessary to demonstrate

compliance with the obligations set out in this Agreement and, at the Data Exporter’s request, allow for and

contribute to audits of the processing activities covered by this Agreement, at reasonable intervals or if there

are indications of non-compliance. The Data Exporter may choose to conduct the audit by itself or mandate an

independent auditor to do so. Audits may include inspections at the premises or physical facilities of the Data

Importer and shall, where appropriate, be carried out with reasonable notice.

d. The Parties shall make the information referred to in the previous paragraphs, including the results of any

audits, available to the Competent Supervisory Authority upon request.

a. Processing by the Data Importer shall only take place for the duration specified in Annex B to this Agreement.

b. After the end of the provision of the processing services, the Data Importer shall, at the request of the Data

Exporter, securely delete all Personal Data processed on behalf of the Data Exporter and certify to the Data Ex-

porter that it has done so, or return to the Data Exporter all Personal Data and securely delete existing copies,

should the Data Exporter choose the latter option.

c. Until the data is deleted or returned, the Data Importer shall continue to ensure compliance with this Agree-
ment. In case of local laws applicable to the Data Importer that prohibit return or deletion of the Personal Data,
the Data Importer warrants that it will continue to ensure compliance with this Agreement and will only process
the data to the extent and for as long as required under that local law.

[OPTION 1: SPECIFIC PRIOR AUTHORISATION]:

a.   The Data Importer may only sub-contract the processing activities it performs on behalf of the Data Exporter

under this Agreement to a Sub-processor with the Data Exporter’s prior specific written authorization. The Data

Importer shall submit the request for specific authorization at least within 15 business days prior to the enga-

gement of the Sub-processor, together with the information necessary to enable the Data Exporter to decide on

the authorization. The list of Sub-processors already authorized by the Data Exporter can be found in Annex D to

this Agreement. The Parties shall keep Annex D up to date.

7.1. Sub-processor authorization form

7.2. Data sub-processor agreement

Clause 8.
Rights of data subjects

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

38

a. Where the Data Importer engages a Sub-processor to carry out specific processing activities (on behalf
of the Data Exporter), it shall do so by way of a written contract that provides for, in substance, the same data
protection obligations as those binding the Data Importer under this Agreement, including in terms of Third-Party
Beneficiary rights for Data Subjects. The Parties agree that, by complying with this provision, the Data Importer
fulfils its obligations under the clause on Onward Transfers. The Data Importer shall ensure that the Sub-proces-

sor complies with the obligations to which it is subject pursuant to this Agreement.

b. The Data Importer shall provide the Data Exporter, at the latter’s request, with a copy of the Sub-processor
agreement and any subsequent amendments thereto. To the extent necessary to protect business secrets or
other confidential information, including Personal Data, the Data Importer may redact the text of the agreement
prior to sharing a copy thereof.

c. The Data Importer shall remain fully responsible to the Data Exporter for the performance of the Sub-pro-
cessor’s obligations under its agreement with the Data Importer. The Data Importer shall notify the Data Exporter
of any failure by the Sub-processor to fulfil its obligations under that agreement.

a. The Data Importer shall promptly notify the Data Exporter of any request it has received from a Data Subject.

It shall not respond to such a request itself unless it has been authorized to do so by the Data Exporter.

b. The Data Importer shall assist the Data Exporter in fulfilling its obligations to respond to Data Subjects’

requests in the exercise of their rights under the Governing Law. In this regard, the Parties shall set out in An-

nex C the appropriate Administrative, Physical and Technical Measures, taking into account the nature of the

Processing, by which they ensure the assistance to the Data Exporter, as well as the scope and the extent of the

assistance required.

[OPTION 2: GENERAL WRITTEN AUTHORISATION]:

a.   The Data Importer has the Data Exporter’s general authorization to contract the Sub-processors included in

the agreed list. The Data Importer shall specifically inform the Data Exporter in writing of any intended changes

to that list through the addition or replacement of Sub-processors at least 15 business days in advance, thereby

giving the Data Exporter sufficient time to be able to object to such changes prior to the engagement of the

Sub-processor(s) in question. The Data Importer shall provide the Data Exporter with the information necessary

to enable the Data Exporter to exercise its right to object.

Clause 9.

Clause 10.

Redress

Civil liability

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

39

c. In fulfilling its obligations under the previous paragraphs, the Data Importer shall comply with the instruc-

tions from the Data Exporter.

a. Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach
of this Agreement.

b. Each Party shall be liable to the Data Subject. The Data Subject shall be entitled to receive compensation
for any material or non-material damages caused by the Data Importer or its Sub-processor for violating the
Third-Party Beneficiary Rights under this Agreement. This is without prejudice to the liability of the Data Exporter
under the Governing Law.

a. The Data Importer shall inform the Data Subjects, in a transparent and easily accessible format, through

individual notice or on its website, of a contact point authorized to handle complaints, who shall handle the

complaints received from Data Subjects as quickly as possible.  [OPTION: The Data Importer agrees that the

Data Subjects may also lodge a complaint with an independent dispute resolution body, at no cost to the Data

Subjects. The Data Importer shall inform the Data Subjects of this redress mechanism, in the manner set out in

this paragraph, and that they are not required to use it or follow a particular sequence in seeking redress.]

b. In case of a dispute between a Data Subject and one of the Parties as regards compliance with this Agree-

ment, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep

each other informed about such disputes and, where appropriate, collaborate in good faith to resolve them.

c. Whenever a Data Subject invokes a Third-Party Beneficiary Right under this Agreement, the Data Importer

undertakes to accept and not dispute the Data Subject’s decision to: (i) lodge a complaint with the Supervisory

Authority in his/her country of habitual residence or place of work, or with the Competent Supervisory Authority;

(ii) file an action in court as regards his/her Personal Data.

d. The Data Importer agrees to abide by decisions  binding under the Governing Law or other applicable law.

Clause 11.

Clause 12.

Supervision by the competent supervisory authority

Local laws and practices affecting compliance with the clauses

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

40

c. The Parties agree that if the Data Exporter is held liable under the previous paragraph for damages caused

by the Data Importer (or its Sub-processor), it shall be entitled to claim back from the Data Importer that part of

the compensation corresponding to the Data Importer’s responsibility for the damage.

d. Where more than one Party is responsible for any damage caused to the Data Subject as a result of a breach

of this Agreement, all responsible Parties shall be jointly and severally liable.

e. The Parties agree that if one Party is held liable under the previous paragraph, it shall be entitled to claim

back from the other Party that part of the compensation corresponding to its responsibility for the damage.

f. The Data Importer may not invoke the conduct of a Sub-processor to avoid its own liability.

a. The Data Importer agrees to submit itself to the jurisdiction of and cooperate with the Competent Supervi-

sory Authority in any procedures aimed at ensuring compliance with this Agreement.

b. In particular, the Data Importer agrees to respond to enquiries, submit to audits and comply with the measu-

res adopted by the Supervisory Authority, especially corrective and compensatory measures. It shall provide the

Supervisory Authority with a written confirmation that the necessary measures have been taken.

a. The Parties confirm that, at the time of entering into this Agreement, they have used reasonable efforts to

identify whether the transferred data is covered by any local law or practice in the Data Importer’s jurisdiction

that goes beyond what is necessary and proportionate in a democratic society to safeguard important public in-

terest objectives, and that may reasonably be expected to affect the safeguards, rights, and guarantees afforded

to the Data Subject under this Agreement. Based on the foregoing, the Parties confirm that they are not aware of

the existence of any such practice or rule that adversely affects the specific safeguards under this Agreement.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

41

b. The Data Importer agrees to notify immediately the Data Exporter if any such laws become applicable to it in

the future. In the event of such notification, or if the Data Exporter has reasons to believe that the Data Importer

is no longer able to perform its obligations under this Agreement, the Data Exporter shall identify appropriate

measures to address the situation (for example, Administrative, Physical and Technical Measures to ensure the

security of the data). Likewise, it may suspend transfers under this Agreement if it considers that adequate sa-

feguards cannot be ensured. In this case, the Data Exporter shall have the right to terminate this Agreement in

accordance with the conditions set out in Clause 13.

c. If a court or government agency requires the Data Importer to disclose or use the transferred data in a

manner not otherwise permitted by this Agreement, the Data Importer shall assess the legality of such request

and challenge it if, after a careful legal assessment, it concludes that there are reasonable grounds to consider

that the request is illegal under local law and that the request affects the rights guaranteed by this Agreement.

To the extent permitted by local law, it shall also promptly notify the Data Exporter that it has received such a

request. If the Data Importer is prohibited by local law from notifying the Data Exporter, the Data Importer shall

use reasonable efforts to obtain a waiver of this prohibition.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

42

Clause 13.
Non-compliance with the clauses and termination

a. The Data Importer shall immediately notify the Data Exporter if it is unable to comply with any provision of

this Agreement, for whatever reason.

b. In the event that the Data Importer fails to comply with its obligations under this Agreement, the Data Ex-

porter shall suspend the transfer of Personal Data to the Data Importer until compliance is again ensured or the

contract is terminated.

c. The Data Exporter shall be entitled to terminate this Agreement when:

d. Personal Data that has been transferred prior to the termination of the contract pursuant to the previous

paragraph shall at the choice of the Data Exporter immediately be returned to the Data Exporter or deleted in its

entirety. The same shall apply to any copies of the data. The Data Importer shall certify the deletion of the data

to the Data Exporter. Until the data is deleted or returned, the Data Importer shall continue to ensure compliance

with this Agreement. In case of local laws applicable to the Data Importer that prohibit the return or deletion of

the transferred Personal Data, the Data Importer warrants that it will continue to ensure compliance with this

Agreement and will only process the data to the extent and for as long as required under that local law.

(i) the Data Exporter has suspended the transfer of Personal Data to the Data Importer pursuant to the pre-

vious paragraph and compliance with this Agreement is not restored within a reasonable period of time and

in any event within a period of thirty (30) business days following suspension;

(ii) the Data Importer is in substantial or persistent breach of this Agreement; or

(iii) the Data Importer fails to comply with a binding decision of a court or Competent Supervisory Authority

regarding its obligations under this Agreement. In this case, it shall inform the Competent Supervisory Autho-

rity of its non-compliance.

SECTION III:
FINAL PROVISIONS

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

43

Clause 14.

Clause 15.

Governing law

Choice of forum and jurisdiction

This Agreement shall be governed by the Governing Law.

a. Any dispute arising from this Agreement shall be resolved by the courts of the Data Exporter’s jurisdiction.

b. Data Subjects may also bring legal action in court against the Data Exporter and/or the Data Importer, which

may be initiated, at the Data Subject’s choice, in the country of the Data Exporter, or in which the Data Subject

has his/her habitual residence. With respect to the Data Importer, s/he may also bring legal action in the country

of the Data Importer.

c. The Parties agree to submit to the competent court(s) provided for in this clause.

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

44

ANNEXES

ANNEX A
ACCESSION FORM FOR NEW PARTIES

ANNEX B
DESCRIPTION OF THE TRANSFER

ANNEX C
ADMINISTRATIVE, PHYSICAL AND TECHNICAL MEASURES
TO ENSURE DATA SECURITY

ANNEX D
LIST OF DATA SUBPROCESSORS

ANNEX E
DOCUMENTACIÓN LEGAL ADICIONAL

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

45

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

46

MODEL AGREEMENT FOR THE INTERNATIONAL TRANSFER OF PERSONAL DATA FROM CONTROLLER TO PROCESSOR

47