DATA PROCESSING AGREEMENT
Australian client privacy and data-handling master template
MASTER TEMPLATE - CLIENT-SPECIFIC FIELDS ARE INTENTIONALLY LEFT BLANK. This document is a working commercial draft, not legal advice. Have
the final pack reviewed by qualified counsel before first use.
This DPA is made on [DD/MM/YYYY] between [CLIENT LEGAL NAME] (“Client”) and Altiora Technologies Private
Limited (“Altiora”), and forms part of the MSA dated [DD/MM/YYYY]
1. Definitions
“Privacy Laws” means the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles and Notifiable
Data Breaches scheme, plus any other privacy/data-protection law that applies to the relevant processing.
“Client Personal Information” means Personal Information Altiora accesses or handles for the Client. “Data
Incident” means actual or reasonably suspected unauthorised access to, disclosure of, loss of or misuse of
Client Personal Information.
“Sub-processor” means a third party engaged by Altiora that handles Client Personal Information for the
Services.
2. Roles and Instructions
The Client determines the purpose of Client Personal Information and is responsible for the lawfulness of the
data and instructions it provides. Altiora handles it only to provide the Services.
Altiora will act only on documented Client instructions in the MSA, this DPA and the SOW, and will notify the
Client if it reasonably believes an instruction is unlawful.
Altiora will not sell Client Personal Information or use it for its own marketing, unrelated analytics, or training
of AI/machine-learning models without the Client’s express written approval.
3. Privacy Handling
Altiora will collect/use only information reasonably needed for the Services, follow Client instructions, take
reasonable steps to keep records accurate when updating them, and assist the Client with access/correction
requests where reasonably required.
Altiora will not independently use Client Personal Information for direct marketing.
4. Overseas Access and Data Location
The Client acknowledges that authorised Altiora personnel may remotely access Client Personal Information
from [CITY, STATE, INDIA].
Altiora will work primarily within Client Systems. It will not intentionally transfer Client Personal Information to
another country or third-party service unless approved by the Client or listed as an approved Sub-processor.
Any local download/storage exception must be expressly documented in the SOW or written Client instruction
and deleted when no longer required.
If legally compelled to disclose Client Personal Information, Altiora will, where lawful, notify the Client and
disclose only what is required.
ALTIORA TECHNOLOGIES | CONFIDENTIAL | Page 2 of 4
5. Reasonable Security Measures
Altiora will maintain reasonable technical and organisational safeguards appropriate to the nature of the
Services and the information handled.
At minimum, where applicable to the engagement: individual accounts; MFA where available; least-privilege
access; password/screen-lock protection; supported operating systems and security updates; reasonable
endpoint protection; confidentiality obligations; no use of personal cloud storage for Client Data; secure
home/office networks; and prompt removal of access when no longer required.
Altiora will not claim certifications, managed-device controls, dedicated secure premises, background-check
programs or other enterprise controls unless they have actually been implemented and, where relevant,
documented in the SOW.
6. Sub-processors
Approved Sub-processors, if any, are listed in Annex 3. Altiora will notify the Client before adding a Subprocessor that will materially handle Client Personal Information and will require appropriate
confidentiality/data-protection terms.
Altiora remains responsible for the processing it delegates to an approved Sub-processor to the extent
required by the parties’ agreement and applicable law.
7. Data Incidents
Altiora will notify the Client without undue delay and within [24 / 48] hours after becoming aware of a Data
Incident affecting Client Personal Information. The parties should select a timeframe they can operationally
meet.
The notice will include information reasonably available about what happened, affected
information/individuals, likely consequences and containment/remediation steps.
Altiora will take reasonable steps to contain and investigate the incident and cooperate with the Client’s
assessment and legally required notifications. The Client controls external notification unless law requires
Altiora to notify directly.
8. Individual Requests and Complaints
Altiora will forward to the Client within [2] Business Days any privacy request or complaint it receives relating
to Client Personal Information and will respond only on the Client’s instructions unless legally required
otherwise.
9. Assistance
Taking account of the Services and information available to it, Altiora will provide reasonable assistance with
access/correction requests, privacy impact assessments, regulator enquiries and data-breach obligations.
10. Audit and Records
Altiora will maintain reasonable records needed to demonstrate compliance with this DPA.
The Client may request a reasonable security questionnaire or compliance information. Any on-site or
independent audit right, frequency, notice period and cost allocation are [TO BE AGREED / COUNSEL TO
CONFIRM], taking into account Altiora’s size and the risk of the Services.
11. Return and Deletion
On termination or written Client request, Altiora will return or delete Client Personal Information reasonably
within its control within [30] days, except information required by law or retained in routine backups, which
remains protected until deleted in the ordinary cycle.
ALTIORA TECHNOLOGIES | CONFIDENTIAL | Page 3 of 4
12. Liability
Liability under this DPA is subject to the MSA, including any privacy/confidentiality cap agreed there. Any
separate cap is [TO BE CONFIRMED WITH COUNSEL].
13. General
This DPA continues while Altiora handles Client Personal Information. If it conflicts with the MSA on privacy
matters, this DPA prevails.
The governing law and dispute mechanism follow the MSA unless applicable Privacy Laws require otherwise.
The parties will reasonably update this DPA if applicable law materially changes.
Annex 1 - Details of Handling
Item Description
Purpose Provision of the Services under the MSA and SOW
Individuals [TENANTS / LANDLORDS / OWNERS / APPLICANTS /
VENDORS / CONTRACTORS / CLIENT STAFF / OTHER]
Types of Personal Information [NAMES / CONTACT DETAILS / ADDRESSES / LEASE OR
TRANSACTION RECORDS / PAYMENT DETAILS /
CORRESPONDENCE / OTHER]
Sensitive Information [NONE EXPECTED / DESCRIBE IF APPLICABLE]
Activities [ACCESS / VIEW / ENTER / UPDATE / ORGANISE / FILE /
COMMUNICATE / OTHER]
Duration Term of the applicable SOW plus return/deletion period
Retention Primarily within Client Systems; any exception: [________]
Annex 2 - Security Measures
Individual named accounts where supported; MFA enabled where available.
Least-privilege access appropriate to assigned tasks; access removed when no longer required.
Password/PIN protected devices with screen lock, supported operating systems and current security updates.
Reasonable endpoint protection and firewall/network protections appropriate to the device and environment.
No intentional storage of Client Data in personal cloud accounts or removable media.
Client Data handled primarily within Client Systems; local storage only if specifically approved.
Confidentiality obligations for personnel who access Client Data.
Basic privacy/security onboarding and incident escalation instructions for personnel with access.
Reasonable incident-response process and prompt Client notification under clause 7.
Additional Client-required controls: [________]