The Third Party Processing Agreement is essential for organizations in South Africa that outsource the processing of personal information to third parties. This agreement is specifically required under the Protection of Personal Information Act (POPIA), which mandates that a responsible party must have a written contract with any operator that processes personal information on its behalf. The agreement ensures compliance with POPIA's requirements while protecting both parties' interests. It covers crucial aspects such as processing limitations, security measures, confidentiality obligations, and breach notification procedures. This document is particularly important given the significant penalties for POPIA non-compliance and the increasing focus on data protection in South Africa. It should be customized based on the nature of processing activities, sensitivity of personal information involved, and specific operational requirements of the parties.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Your data doesn't train Genie's AI
You keep IP ownership of your docs
1. Parties: Identification of the responsible party (data controller) and the operator (data processor)
2. Background: Context of the processing relationship and purpose of the agreement
3. Definitions: Definitions of key terms, incorporating POPIA terminology and agreement-specific definitions
4. Appointment and Scope: Formal appointment of the operator and scope of processing activities authorized
5. Duration: Term of the agreement and renewal provisions
6. Operator Obligations: Core obligations including processing limitations, security measures, and compliance with POPIA
7. Security Requirements: Specific security measures and standards required for data protection
8. Confidentiality: Confidentiality obligations regarding processed personal information
9. Sub-processing: Conditions and requirements for engaging sub-processors
10. Data Subject Rights: Procedures for handling data subject requests and ensuring rights under POPIA
11. Personal Information Breaches: Breach notification and management procedures
12. Audit Rights: Right of responsible party to audit compliance and operator's obligations to demonstrate compliance
13. Return or Destruction of Data: Requirements for data handling upon agreement termination
14. Liability and Indemnity: Allocation of liability and indemnification provisions
15. Termination: Termination rights and consequences
16. General Provisions: Standard contractual provisions including notices, governing law, and dispute resolution
1. Cross-border Transfers: Required when personal information will be transferred outside South Africa
2. Special Personal Information: Required when processing special categories of personal information under POPIA
3. Insurance Requirements: Specific insurance obligations for high-risk processing activities
4. Business Continuity: Required for critical processing services requiring disaster recovery planning
5. Change Control: Formal process for managing changes to processing activities or security measures
6. Service Levels: Required when specific performance metrics need to be maintained
7. Charges and Payment: Required when processing services are provided for a fee
1. Processing Activities: Detailed description of authorized processing activities, categories of data subjects and personal information
2. Security Measures: Technical and organizational security measures to be implemented
3. Approved Sub-processors: List of pre-approved sub-processors and their processing activities
4. Data Transfer Mechanisms: Details of mechanisms used for lawful cross-border data transfers
5. Contact Details: Key contacts for operational, security, and breach notification purposes
6. Technical Requirements: Technical specifications and requirements for processing systems
7. Service Levels: Detailed service level requirements and measurement criteria
Find the exact document you need
International Data Transfer Addendum
A South African law-compliant addendum governing international transfers of personal information under POPIA requirements.
Download
Intra Group Data Processing Agreement
A South African law-governed agreement regulating personal information processing between entities within the same corporate group, ensuring POPIA compliance.
Download
Third Party Processing Agreement
A South African law-governed agreement regulating personal information processing between a responsible party and an operator under POPIA.
Download
Data Processing Addendum
A South African law-compliant agreement governing personal information processing between controllers and processors under POPIA.
Download
Intercompany Data Transfer Agreement
South African law-governed agreement regulating intra-group data transfers in compliance with POPIA and local data protection regulations.
Download
Data Management Agreement
A South African law-compliant agreement governing data management and processing activities between organizations, ensuring POPIA compliance and data protection.
Download
Data Controller To Data Controller Agreement
South African POPIA-compliant agreement governing personal information sharing between two data controllers, establishing mutual obligations and responsibilities.
Download
DPA Agreement
A South African law-compliant Data Processing Agreement establishing terms for handling personal information under POPIA regulations.
Download
Third Party Data Processing Agreement
A South African law-compliant agreement governing the processing of personal information by a third-party operator on behalf of a responsible party under POPIA.
Download
Personal Data Transfer Agreement
A POPIA-compliant agreement for transferring personal information between parties under South African law.
Download
Controller Processor Agreement
A South African law-governed agreement between a data controller and processor establishing terms for personal information processing under POPIA.
Download
Affiliate Addendum
A South African law-compliant addendum establishing terms and conditions for affiliate marketing relationships, including commission structures and compliance requirements.
Download
Sub Processing Agreement
A South African-compliant agreement governing the delegation of personal information processing activities to a sub-processor under POPIA requirements.
Download
International Data Transfer Agreement
A South African law-governed agreement for cross-border personal information transfers, ensuring POPIA compliance and data protection standards.
Download
Data Protection Addendum
A South African law-governed addendum establishing POPIA-compliant terms for personal information processing between parties.
Download
ұԾ’s Security Promise
Genie is the safest place to draft. Here’s how we prioritise your privacy and security.
Your documents are private:
We do not train on your data; ұԾ’s AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it
.png)