A Brief Introduction of Data Transfer Agreement
A data transfer agreement is an agreement that is entered into between two organizations for the purpose of transferring or sharing data. Through this agreement, the parties agree to share data among themselves in accordance with certain predetermined terms and conditions.
There are situations when sensitive data is shared between countries and this agreement is required in such situations too. This agreement contains all the details regarding the transfer and use of the data and hence protects the interests of the parties.
Who Takes the Data Transfer Agreement?
A data transfer agreement is entered between the parties who wish to transfer any kind of data between themselves. These parties comprise of any two organizations or countries also.
Purpose of the Data Transfer Agreement
The purpose of a data transfer agreement is to provide conditions for the use of the data that is being transferred. The party that is transferring the data can lay certain down certain stipulations regarding the purpose for which such data is being transferred and the manner in which the same is to be used. This agreement is usually created in a situation where misuse of the data may lead to a risky state of affairs.
Such agreements will be governed by national laws. For example, under European laws, where personal data is being transferred outside the European Economic Area (EEA), there are a number of requirements that need to be met. These are elaborated in Data Sharing agreements. Data sharing agreements must incorporate GDPR (General Data Protection Regulation) requirements. These agreements will include data security contract clauses.
Contents of the Data Transfer Agreement
The contents include
- Details of the agreement made between Lead Customer Company and lead vendor company
- Background Info of the companies involved
-
- The Customer Companies and the Vendor Companies must make arrangements for transfer of personal data from the Customer Companies to the Vendor Companies.
- The Parties must agree to enter into this Agreement and the Model Clauses.
- The Lead Customer Company acts as if it has signed a copy of the Agreement and agreed to be bounded by the terms and conditions.
- And Lead Vendor Company shall accept the terms and conditions of this Agreement on its behalf.
- Agreed Definitions and Interpretations
- Guiding Principles
- Obligation of both paties
- Costs and Payment Arrangement
- Warranties
- Legal Title to Data Transfered and Benefit Sharing
- Permits, Licenses and approvals
- Termination, Applicable Law and Severability
The agreement must first identify the parties between whom the agreement is being created. It must then describe the data that is being transferred in detail. The agreement should include a clause that dictates how the data is to be used by the recipient and may also lay down a provision restricting the transfer of the data to any third person without the consent of the party who has transferred it.
The obligations of the person who is receiving the data must be listed out in detail. The representations and warranties of both parties must be made part of the agreement. Representations and warranties will include statements made by the parties about their competency to enter into the agreement and carry out their duties under it.
Under GDPR requirements, special data processing provisions must be made part of the agreement. When data is transferred to a processor for processing, the agreement must include details such as nature and purpose of processing, duration of the processing, the subject matter of processing and other such details.
The agreement must also have a provision that details the remedies that will be available to the parties if there is a breach of the terms of the agreement or if there is any dispute between the parties. An alternative dispute redressal mechanism may be set up under the agreement. The circumstances under which the agreement may be terminated also must be stated therein.
How to Draft the Data Transfer Agreement?
The following are the steps to follow while drafting a data transfer agreement:
- The parties must decide among themselves the method by which the data shall be used or the data may be processed.
- The agreement must be drafted in such a manner that it includes every aspect of the transaction.
- The agreement must comply with all the laws that are applicable to it. This is very important when any personal data is being shared.
- The agreement must be signed by the concerned parties.
The negotiations in a data transfer will mainly revolve around the use of the data and restrictions on transfer to third parties.The agreement should be balanced equally between both parties.
Benefits and Drawbacks of the Data Transfer Agreement
The following are the benefits and drawbacks of this agreement:
- This agreement is extremely beneficial whenever any kind of data is being transferred as it serves as proof of the entire transaction.
- This agreement is necessary to record the terms and conditions under which the data is being transferred.
- If this contract is not created by the parties, they will be no record of the transferor any of the clauses agreed to between the parties.
- This agreement can help to protect the sensitive nature of certain data and prevent any misuse of the same.
What Happens in Case of Violation?
In case there is a breach of the terms of the agreement by either party, the non-breaching party can serve a notice on the breaching party asking it to cure the breach if the breach is such that it can be remedied. The breaching party will be given a certain time period within which the breach must be cured by it. If this is not done and the breach continues, the non-breaching party will have the option of terminating the agreement. The party that is transferring the data may also choose to suspend such transfer when such a breach has occurred.
The parties may also choose to include an arbitration or mediation clause in the agreement to resolve any dispute that may arise in an amicable manner. The process through which such arbitration or mediation will be carried out must be laid down(1).
Whenever any data is being transferred between organizations or between countries for any purpose whatsoever, it is imperative to enter into this agreement to safeguard the interests of all the parties involved. This agreement is extremely important and can go a long way in preventing any misuse of sensitive data.