第三方数据共享协议起草

Cross-Border Third-Party Data Sharing: Risk Identification, Safeguards, Transfer Addendum, Notification Process, and Audit Evidence Package

1. Purpose and Scope This document provides:

• A risk register for cross-border sharing of personal data with third-party vendors.
• Required safeguards aligned with GDPR, UK GDPR, CCPA/CPRA, and other commonly applicable regimes.
• A Data Transfer Addendum (DTA) template that incorporates the EU Standard Contractual Clauses (SCCs) and jurisdictional addenda.
• A notice and escalation process covering privacy notices, regulatory/individual notifications, incidents, and vendor change events.
• An audit evidence and record-keeping framework to demonstrate compliance.

This material is designed for controller-to-processor, processor-to-processor, and controller-to-controller transfers. Tailor role allocation and annexes to your actual processing model.

2. Risk Identification (Cross-Border Third-Party Sharing) 2.1 Jurisdictional and legal risk

• Inadequate legal framework in destination country; access to data by public authorities without redress.
• Conflicts of law impacting SCCs or contractual commitments.
• Data localization or filing requirements (e.g., China PIPL, sectoral rules).

2.2 Transfer mechanism sufficiency

• Absence of a valid mechanism (e.g., SCCs, EU-US DPF certification, UK IDTA/Addendum, BCRs).
• Incomplete Transfer Impact Assessment (TIA) or DPIA for high-risk processing.

2.3 Technical and organizational security risk

• Weak encryption or key management; lack of pseudonymization.
• Insufficient access controls, monitoring, vulnerability management, and segregation of duties.
• Inadequate incident response and business continuity.

2.4 Purpose limitation and use controls

• Vendor use beyond instructions (profiling, advertising, model training).
• Onward transfers to sub-processors without equivalent protections.

2.5 Data subject rights and transparency

• Inability to honor access, deletion, correction, portability, and objection.
• Lack of clarity in privacy notices regarding cross-border transfers.

2.6 Data minimization, retention, and deletion

• Excessive collection or retention beyond necessity.
• Incomplete return/deletion at contract termination.

2.7 Special categories and children’s data

• Sensitive data or children’s data requiring enhanced controls or explicit consent.

2.8 CCPA/CPRA-specific risk

• Relationships misclassified (third party vs service provider/contractor) leading to “sale”/“sharing” exposure.
• Missing required CPRA contractual terms and opt-out mechanisms.

2.9 Operational risks

• Vendor insolvency or acquisition changing risk posture.
• Insufficient change notification (e.g., new hosting region, new subprocessor).
• Ineffective training and oversight.

3. Safeguards and Control Framework 3.1 Legal and governance

• Execute a DPA under GDPR Article 28 (if processor involved) or a controller-to-controller agreement with privacy commitments.
• Implement a transfer mechanism for each cross-border flow:
  • EU/EEA and UK: SCCs (appropriate module 1/2/3) plus TIA; UK Addendum/IDTA and Swiss Addendum as applicable.
  • EU-US DPF/UK Extension/Swiss-US DPF: may be used where recipient is certified; consider SCCs fallback where prudent.
  • BCRs if applicable. Document scope and coverage.
  • If China PIPL applies: conduct PIPIA; obtain separate consent for export; use CAC security assessment where thresholds are met; or PRC Standard Contract plus filing; or accredited certification. Ensure flow-down obligations.
• Maintain data maps and Records of Processing (GDPR Art. 30).
• Perform and document TIAs and DPIAs for high-risk processing.

3.2 Contractual controls (flow down to all subprocessors and onward recipients)

• Purpose limitation; processing only on documented instructions.
• Prohibition on selling or sharing personal information; ban on combining data except as permitted (CPRA).
• No advertising or training of models using customer data without explicit written permission.
• Subprocessor approval and notice; ensure SCCs or equivalent for onward transfers.
• Security, confidentiality, breach notification (within 24–48 hours; GDPR authority notification within 72 hours by the controller).
• Audit and monitoring rights; remediation timelines; suspension/termination for cause.
• Return/deletion upon termination; certificates of destruction.
• Government access: notify, challenge, minimize, and keep transparency logs.
• Data subject rights assistance; cooperation on regulatory inquiries and DPIAs.
• Indemnities, liability caps consistent with risk.

3.3 Technical safeguards (examples; tailor to risk)

• Encryption in transit (TLS 1.2/1.3) and at rest (AES-256 or equivalent). Strong key management using HSM/KMS; keys logically or physically segregated; customer-managed keys where feasible.
• Pseudonymization/anonymization where possible; minimize direct identifiers in transfers.
• Access controls: least privilege, MFA, fine-grained RBAC/ABAC; quarterly access reviews.
• Network security: segmentation, WAF, IDS/IPS, hardening benchmarks (CIS), secure configuration baselines.
• Secure development and change management; code review, SAST/DAST, SBOM; third-party library management.
• Vulnerability management: timely patching; quarterly scanning and at least annual penetration testing.
• Logging and monitoring: immutable logs; centralized SIEM; alerting on anomalous access and exfiltration; audit trails for administrative actions.
• Data Loss Prevention and egress controls for exports and downloads.
• Backup, DR, and tested restoration; RTO/RPO targets per criticality.

3.4 Organizational safeguards

• Security policies, secure coding standards, and privacy by design procedures.
• Training on privacy/security; role-based training for admins and engineers.
• Incident response playbooks and tabletop exercises.
• Vendor management lifecycle: onboarding diligence, periodic reassessments, and contractual updates.

4. Data Transfer Addendum (Template) Use this addendum in addition to your Master Services Agreement and DPA. Complete Annexes with data details.

4.1 Parties and roles

• Exporter: [Legal name], role: [Controller/Processor]
• Importer: [Legal name], role: [Processor/Sub-processor/Controller]
• Affiliates: [Included/Excluded] under this DTA.

4.2 Incorporation of transfer mechanisms

• EU/EEA transfers: The European Commission Standard Contractual Clauses (2021/914) are incorporated by reference, with the module selected per Annex I:
  • Module 1: Controller to Controller
  • Module 2: Controller to Processor
  • Module 3: Processor to Processor
• UK transfers: The UK Information Commissioner’s Office Addendum to the EU SCCs (or UK IDTA) is incorporated for UK-origin transfers.
• Switzerland: Swiss Addendum applies for Swiss-origin transfers.
• Where the Importer maintains a valid certification under the EU-US DPF (and relevant UK/Swiss extensions), the Parties may rely on that certification for eligible data. If certification lapses or scope is insufficient, SCCs remain the default mechanism.
• If China PIPL applies: Parties will, where required, execute the PRC Standard Contract for personal information export and file with competent authority; or complete a CAC security assessment or certification, as applicable. The terms of such instruments prevail for Chinese-origin data where stricter.

4.3 Supplementary measures (Schrems II)

• The Importer implements the technical, organizational, and contractual safeguards in Annex II.
• The Importer has not created backdoors or lawful access interfaces and will not intentionally weaken or subvert encryption.
• The Importer will promptly notify the Exporter of government access requests (unless legally prohibited), will challenge unlawful or overbroad requests, and will disclose only the minimum required. The Importer will publish annual transparency reports where legally permissible.
• The Parties have completed a TIA covering laws and practices in the destination country and will review it upon material change.

4.4 Processing instructions and limitations

• The Importer will process personal data solely for the purposes described in Annex I and in accordance with Exporter’s documented instructions.
• No selling or sharing of personal information (as defined by CPRA). No profiling, advertising, or model training using the data without prior written authorization.

4.5 Subprocessors and onward transfers

• The Importer shall obtain the Exporter’s prior written authorization for subprocessors listed in Annex III and provide at least [15] days’ prior notice for changes. The Exporter may reasonably object.
• The Importer shall flow down equivalent protections, including SCCs or other valid mechanisms for further cross-border transfers.

4.6 Security and confidentiality

• The Importer maintains TOMs in Annex II appropriate to the risk (GDPR Art. 32).
• Personnel are bound by confidentiality obligations and receive appropriate training.

4.7 Incident response and breach notification

• The Importer shall notify the Exporter without undue delay and no later than [24–48] hours after becoming aware of a security incident affecting the personal data, providing details sufficient for the Exporter’s assessment and regulatory notifications under GDPR Articles 33/34 and applicable laws.
• The Importer will cooperate to remediate and to support notifications to authorities and individuals.

4.8 Assistance with data subject and regulator requests

• The Importer shall promptly forward and assist with data subject requests and regulator inquiries related to the data; no responses will be made without the Exporter’s instruction unless legally required.

4.9 Audits and compliance verification

• Upon reasonable notice, the Exporter or an independent auditor may audit Importer’s relevant facilities, systems, and records, or rely on recent third-party assessments (e.g., ISO 27001, SOC 2 Type II) plus a questionnaire, where sufficient.
• Material nonconformities must be remediated on a defined timeline; the Exporter may suspend transfers if unresolved.

4.10 Retention, return, and deletion

• Data will be retained only as necessary for agreed purposes and legal obligations. Upon termination or upon request, the Importer will return and then securely delete personal data, confirming deletion in writing.

4.11 Records, TIAs, DPIAs

• The Importer maintains records of processing, access logs, subprocessor lists, and government request logs.
• The Exporter maintains TIAs and DPIAs where required and may request evidence supporting the Importer’s safeguards.

4.12 Liability, suspension, and termination

• Either party may suspend data transfers or terminate the DTA if the Importer is unable to comply.
• Liability is allocated per the main agreement, except where mandatory SCC provisions prevail.

4.13 Order of precedence

• In case of conflict: SCCs (and applicable addenda) prevail; then this DTA; then the main agreement.

Annex I: Data Processing and Transfer Details

• Subject matter and duration: [Describe service and term]
• Nature and purpose: [e.g., hosting, support, analytics]
• Categories of personal data: [e.g., customer contact details, usage data, payment tokens]
• Special categories: [If any; specify or state none]
• Vulnerable groups/children’s data: [If any]
• Categories of data subjects: [e.g., customers, end users, employees]
• Frequency and volume: [continuous/batch; approximate volumes]
• Locations of processing and storage: [countries/regions]
• Roles and selected SCC Module(s): [Module 1/2/3]
• Transfer mechanism(s) in scope: [SCCs, DPF certification ID, BCRs, etc.]
• Retention periods: [per category]

Annex II: Technical and Organizational Measures (TOMs)

• Information security management: policy suite; risk assessments; ISO 27001 or equivalent framework.
• Asset management: inventories; data classification; least privilege; MFA; PAM for administrative access.
• Cryptography: TLS 1.2/1.3; AES-256 at rest; HSM/KMS with key rotation and split duties; customer-managed keys when feasible.
• Application security: SDLC with SAST/DAST; code review; dependency scanning; SBOM; change control; secrets management.
• Infrastructure security: hardening baselines; segmentation; WAF; IDS/IPS; anti-malware; EDR; secure logging.
• Monitoring and logging: centralized SIEM; immutable logs; time sync; alerting on anomalies and exfiltration; retention period [e.g., 12–24 months].
• Vulnerability and patch management: scanning cadence; risk-based patch SLAs (e.g., critical: 7 days).
• Data protection: minimization; pseudonymization; DLP; egress restrictions; secure deletion standards (e.g., NIST SP 800-88).
• Business continuity: backups with encryption; DR testing; documented RTO/RPO.
• Incident response: playbooks; roles; notification matrix; forensics readiness.
• Vendor and subprocessor management: vetting; contractual controls; ongoing monitoring.
• Privacy by design: DPIA/PbD checklists; change reviews; data lifecycle management.

Annex III: Authorized Subprocessors

• List legal names, services, locations, transfer mechanisms, and security attestations (e.g., SOC 2, ISO 27001).
• Provide URL for dynamic list and subscription to change notifications.

Jurisdictional Annexes (as applicable)

• UK: Complete ICO Addendum Tables 1–4 or adopt the UK IDTA. Identify chosen approach.
• Switzerland: Specify that references to EU GDPR include Swiss FADP, with adaptations (e.g., definitions, governing law).
• China PIPL: Attach PRC Standard Contract and evidence of filing where required; include PIPIA summary and separate consent capture. Note any CAC security assessment or certification outcome.

Signatures

• Authorized signatory for Exporter: [Name, Title, Date]
• Authorized signatory for Importer: [Name, Title, Date]

5. Notification and Escalation Process 5.1 Pre-transfer transparency and notices

• Privacy notice: Update to include categories of personal data, purposes, categories of recipients (including cross-border), transfer mechanisms (e.g., SCCs/DPF), retention, and rights. Provide jurisdiction-specific disclosures (e.g., CCPA categories, sensitive PI).
• Consent: Obtain consent where required (e.g., cookies/ePrivacy; explicit consent for special categories; separate consent for PIPL cross-border exports).
• Records: Update ROPA and data maps to reflect cross-border flows.

5.2 Regulatory consultations

• DPIA: Conduct for high-risk processing; if residual high risk remains, consult supervisory authority (GDPR Art. 36).
• China PIPL: Where thresholds are met, complete CAC security assessment; file PRC Standard Contract within required timeframe (currently 10 working days from effectiveness).

5.3 Vendor change and subprocessor notifications

• Vendor must provide at least [15] days’ notice of new/changed subprocessors, material changes in hosting locations, or material security changes. The controller may object and, if unresolved, suspend transfers.

5.4 Security incident notifications

• Vendor to notify within [24–48] hours with: incident summary, systems/data affected, number and types of data subjects, preliminary impact, containment actions, and contact point.
• Controller assesses GDPR Article 33/34 triggers and other jurisdictional triggers, and issues notifications within deadlines (e.g., GDPR 72 hours to authority; prompt notice to individuals if high risk).

5.5 CCPA/CPRA notices and opt-outs

• If data is disclosed to a service provider/contractor: ensure contract contains CPRA-required terms and confirm no “sale”/“sharing.”
• If disclosed to a third party: provide “Do Not Sell or Share” mechanism; honor global privacy control (GPC); include children’s data rules (opt-in for under 16).

5.6 Government access requests

• Vendor will notify and challenge overbroad requests; maintain a government request log; provide de-identified transparency reports where permissible.
• Escalate to Exporter DPO/Counsel within [24] hours of receipt.

5.7 Internal escalation and RACI

• DPO/Privacy: lead on legal assessments (DPIA/TIA, notices).
• Security: lead on incident containment, forensics, and evidence preservation.
• Procurement/Vendor Mgmt: ensure contract compliance and change tracking.
• Communications/PR: manage public statements if needed.
• Executive sponsor: approve risk acceptance or suspension decisions.

6. Audit Evidence and Record-Keeping Framework 6.1 Evidence to collect and maintain

• Governance: ROPA entries; data flow diagrams; DPIAs; TIAs; privacy notices; consent records; policy approvals.
• Contracts: executed DPA, DTA/SCCs and annexes; CPRA service provider/contractor addendum; PRC Standard Contract and filing evidence (if applicable); subprocessor list approvals.
• Security: ISO 27001/SOC 2 reports; pen test reports and remediation plans; vulnerability scans; access review attestations; encryption and key management procedures; backup/DR test results; change control tickets.
• Operations: incident logs and post-incident reports; government request logs; subprocessors change notifications; training attendance; DSR logs and response evidence; deletion/return certificates upon termination.
• CCPA/CPRA: notice at collection; sale/share opt-out logs; GPC handling; annual audits where required by risk profile.
• China PIPL (if applicable): PIPIA; consent records; export logs; CAC filings; periodic reassessments.

6.2 Retention periods

• Contracts and TIAs/DPIAs: term plus 6 years or per statutory limit, whichever is longer.
• Security logs: minimum 12 months; longer where required by sector or risk.
• Incident and DSR records: at least 3 years (longer for material incidents).
• PIPL export logs and contracts: per regulatory requirement (keep accessible for audits).

6.3 Storage and integrity controls

• Central evidence repository with access control, versioning, and immutable audit trails.
• Evidence indexing by vendor, dataset, jurisdiction, and control domain.
• Quarterly evidence refresh and annual comprehensive review.

7. Vendor Onboarding and Reassessment Workflow

• Intake: define roles, purposes, data categories, destinations, and lawful bases.
• Risk screening: inherent risk rating (data sensitivity, volumes, special categories, children, regulated data).
• Diligence: security/privacy questionnaire, certifications, pen test summary, subprocessor map, breach history.
• Legal instruments: MSA, DPA, DTA (SCCs and addenda), CPRA terms; PIPL contractual steps if applicable.
• Assessments: DPIA and TIA; remediation plan; risk acceptance/suspension decision.
• Go-live controls: configure encryption, access, logging, DLP; deploy keys; validate data minimization.
• Monitoring: SLA reviews; subprocessor changes; vulnerability management; annual/trigger-based reassessment.
• Offboarding: data return/deletion; certificate of destruction; revoke access; archive evidence.

8. CPRA Service Provider/Contractor Required Terms (Include in DPA/DTA where applicable)

• Process personal information only for the limited and specified business purposes.
• Comply with applicable sections of CPRA and provide the same level of privacy protection.
• Grant the business rights to take reasonable steps to ensure compliance, including audits.
• Notify the business if unable to comply; allow the business to stop and remediate unauthorized use.
• Prohibit selling or sharing personal information; prohibit combining personal information received from different sources except as permitted by CPRA.
• Flow down obligations to subprocessors via written contract.
• Assist the business with consumer requests and deletion upon instruction.

9. China PIPL Cross-Border Overlay (If Applicable)

• Conduct a PIPIA addressing purpose necessity, impact on rights, security risks, and foreign legal environment.
• Obtain separate consent for export; present recipient identity, contact, purpose, categories, and methods of processing, storage location, retention, and how rights are exercised overseas.
• Choose export pathway:
  • CAC security assessment if thresholds or important data apply; or
  • PRC Standard Contract with overseas recipient and file within required timelines; or
  • Accredited certification; or
  • Other lawful mechanisms recognized by regulators.
• Maintain export logs, contracts, and filing evidence; re-evaluate upon material changes.

10. Appendices: Checklists and Templates 10.1 TIA checklist (summary)

• Data, purposes, and necessity.
• Recipient’s role, TOMs, certifications.
• Destination country laws and practices on government access and redress.
• Risk of onward transfers; encryption feasibility; key control.
• Residual risk rating and supplementary measures.
• Review cadence and triggers for re-assessment.

10.2 DPIA triggers (examples)

• Large-scale processing of sensitive categories.
• Systematic monitoring/profiling with significant effects.
• Processing of children’s data.
• Innovative technologies or AI with significant risks.

10.3 Government request log fields

• Requesting authority, legal basis, scope, date, data sought, notification feasibility, challenge outcome, data disclosed (if any).

10.4 Data subject request log fields

• Request type, identity verification, systems and vendors involved, response actions, completion date.

How to Use This Package

• Complete Annexes I–III and jurisdictional addenda for each vendor transfer.
• Run the TIA and DPIA, document decisions, and store all evidence.
• Implement the notification process and RACI, and test incident drills.
• Schedule periodic reassessments and evidence updates.

Note: This template is intended to operationalize compliance and should be reviewed and adapted by qualified counsel to reflect your industry, jurisdictions, and specific processing activities.

第三方数据共享与处理协议（供应商版）

本协议用于引入新供应商时之数据共享与处理安排，确保各方遵守适用数据保护法规（包括但不限于GDPR、UK GDPR、CCPA/CPRA、LGPD等），明确数据范围、保留期限与责任分工，并设立加速条款以提升条款对齐与签约效率。

一、定义与适用范围

1. 甲方：数据控制者（Business/Controller）。
2. 乙方：供应商，作为数据处理者（Processor）及/或服务提供商/承包商（Service Provider/Contractor）。
3. 个人数据：可识别自然人的任何信息（包括CPRA下的“敏感个人信息”）。
4. 处理：对个人数据进行的任何操作（收集、存储、使用、传输、披露、销毁等）。
5. 子处理者：受乙方委托参与数据处理的第三方。
6. 适用法规：GDPR及UK GDPR第28条及相关条款，CCPA/CPRA的服务提供商/承包商合同要求，以及其他适用的隐私与数据安全法律。

二、合同目的与处理范围

1. 目的：乙方仅为履行本合同项下之服务[填写服务名称/模块]而处理甲方共享的数据，不得用于任何未授权目的。
2. 范围：数据共享与处理的场景、系统接口、频次与处理活动详见附录A（数据清单与共享矩阵）。
3. 禁止用途：乙方不得为自身或第三方的独立目的使用数据；不得进行出售或共享（CPRA意义上的“跨情境行为广告”）或建立独立档案；不得将数据与来自其他来源的数据进行不当合并以改变用途或合法性基础。

三、角色与合规框架

1. 角色：甲方为数据控制者，乙方为数据处理者。在CCPA/CPRA下，乙方为服务提供商/承包商。
2. 合规义务：本协议条款满足GDPR第28条之最低合同要求，并满足CCPA/CPRA对服务提供商/承包商的合同义务，包括：不出售/共享个人信息、仅依据合同目的处理、协助履行消费者请求、允许合理审计与证明合规。

四、数据范围与分类（详见附录A）

1. 数据类别示例：
   • 基本标识：姓名、职位、公司、联系方式（电话、邮箱）。
   • 账号信息：用户ID、角色、权限、认证日志。
   • 交易/业务数据：订单、发票、合同元数据。
   • 技术与设备数据：IP地址、设备标识、Cookie/SDK事件、日志。
   • 风险与合规数据：欺诈信号、风控标签、访问审计日志。
   • 敏感个人信息（如适用且经授权）：政府证件号、地理精确位置、财务账号、健康/生物识别数据。敏感信息需最小化与增强保护。
2. 数据来源：甲方系统与用户接口；乙方不得从非授权渠道获取或补充数据。
3. 数据最小化：仅处理达成本合同目的所必需的最少数据与最短时间。

五、合法性基础与透明度

1. 甲方负责确定并记录处理的合法性基础（同意、合同履行、合法权益等），并向数据主体提供适当的隐私通知。
2. 乙方仅依据甲方的书面处理指令行事；如指令可能违反适用法律，乙方应及时书面告知并暂停执行。

六、保留期限与数据删除（详见附录E）

1. 保留原则：遵循存储限制与目的限制。各数据集的具体保留期限见附录E。
2. 删除要求：
   • 正常到期删除：乙方应在保留期届满后30日内完成安全删除并出具删除证明。
   • 终止时数据返还与删除：合同终止后，乙方应在30日内向甲方返还所有个人数据及派生数据（不含乙方独立知识产权），随后在60日内完成不可逆删除（含备份与日志体系），并出具证明。
   • 备份与冗余：删除将覆盖所有线上与离线副本；归档/备份中的删除可在技术上以定期循环覆盖方式执行，但不得超过90日。
   • 例外情形：法律留存或审计需要的保留应最小化并隔离存放；解除原因后立即删除。

七、处理指令与变更管理

1. 指令形式：经甲方授权的书面指令（合同、附录、邮件、工单系统）为准。
2. 变更控制：对数据范围、传输目的、子处理者或安全措施的重大变更需经甲方书面批准。
3. 合法性提醒：乙方若发现指令可能导致合规风险，应立即书面通知甲方并提出替代方案。

八、安全措施（详见附录B）

1. 乙方须建立与维护适当的技术与组织安全措施，包括但不限于：加密（传输与静态）、访问控制与最小权限、身份鉴别与多因素认证、漏洞管理与渗透测试、安全开发生命周期、日志与监控、网络分段与防火墙、密钥与秘密管理、数据脱敏/伪匿名化、备份与灾难恢复（含RTO/RPO目标）、员工背景审查与隐私安全培训。
2. 合规证明：乙方应提供有效的合规证明（如ISO/IEC 27001、SOC 2 Type II或等效），以及年度安全评估报告。

九、保密与人员管理

1. 保密义务：乙方及其人员（含承包商）对甲方数据与信息负有保密义务，仅在履约必要范围内访问。
2. 人员访问：实施基于角色的访问控制与审批流程；离职或角色变更应在24小时内收回权限。

十、子处理者管理（详见附录F）

1. 事先授权：乙方须获得甲方书面同意方可委托子处理者，并向甲方提供清单、处理目的与安全评估。
2. 异议权：甲方可在收到新增子处理者通知后10个工作日内提出合理异议；若无法解决，甲方可暂停相关处理或终止本协议的相关部分。
3. 传递义务：乙方须确保与子处理者签订等效数据保护条款并监督其履行。

十一、数据主体权利协助

1. GDPR权利：访问、更正、删除、限制、数据可携、反对等，乙方须在收到甲方指示后合理期间内协助完成（一般不超过15个工作日）。
2. CCPA/CPRA权利：知情、删除、更正、限制敏感信息使用、选择退出分享/定向广告，乙方作为服务提供商/承包商须：
   • 不出售或共享个人信息；
   • 不将个人信息用于跨情境行为广告；
   • 仅根据合同目的与甲方指示处理；
   • 协助甲方响应消费者请求并实施GPC（全球隐私控制）信号的效力（由甲方触发、乙方配合技术屏蔽/不共享）。
3. 请求通道：乙方应设立并公布处理数据主体请求的联络点，且不得直接对数据主体作出实质决定，除非甲方书面授权。

十二、数据泄露与事件响应（详见附录C）

1. 通报义务：乙方在知悉影响甲方数据的安全事件后，应在不迟于24小时内初始通报甲方，并在72小时内提供详细报告（包含事件类型、影响范围、受影响数据类别、初步原因、已采取与拟采取的措施）。
2. 协同处置：乙方须配合甲方进行调查、遏制、修复、监管通报与数据主体通知。乙方不得未经甲方同意对外披露事件信息（法律强制除外）。
3. 事后改进：乙方应在事件关闭后15个工作日内提交根因分析与改进计划，并在约定期限内落地。

十三、跨境传输与传输机制（详见附录D）

1. 跨境限制：任何将个人数据传输至欧盟/英国以外或其他受限司法辖区的安排须经甲方书面批准。
2. 传输机制：
   • 欧盟数据：采用欧盟委员会标准合同条款（SCC 2021/914，模块2/3视角色而定）并进行传输影响评估（TIA），部署补充措施（如强加密、访问限制）。
   • 英国数据：采用UK IDTA或欧盟SCC的英国国际数据传输附加条款（UK Addendum）。
   • 其他地区：使用当地监管认可的机制或数据本地化策略。
3. 美国接收方：如适用，乙方可在满足条件时依托EU-U.S. Data Privacy Framework（仅作为传输机制之一），但仍需评估并适配补充措施。

十四、审计与合规证明

1. 文档与记录：乙方须维护GDPR第30条要求的处理活动记录，提供安全政策、风险评估与第三方审计报告。
2. 审计权：甲方可在提前30日书面通知后进行合理的远程或现场审计（每年不超过一次，紧急事件除外），乙方应配合并在不影响正常运营与安全前提下提供必要信息。审计双方各自承担成本，除非发现重大不合规由乙方承担整改成本。

十五、隐私影响评估与合规协作

1. DPIA/PIA：乙方应在甲方开展隐私影响评估时提供必要的处理信息、风险与缓解措施，并支持监管咨询与问询。
2. 合同变更与新功能：乙方在引入新处理活动或功能前应开展隐私与安全评估并向甲方提交影响说明。

十六、业务连续性与灾难恢复

1. 连续性目标：乙方应制定并测试业务连续性与灾难恢复计划，明确RTO/RPO目标，并至少每年演练一次。
2. 备份保护：备份数据须加密与访问隔离，防止勒索与供应链攻击。

十七、责任分工

1. 甲方责任：
   • 确定合法性基础并发布隐私通知；
   • 向乙方提供准确且必要的数据及处理指令；
   • 统筹数据主体请求与监管沟通；
   • 决定跨境传输策略与批准子处理者。
2. 乙方责任：
   • 遵循甲方指令与本协议条款；
   • 实施与维护适当的安全与合规措施；
   • 及时通报安全事件与合规风险；
   • 管理子处理者并传递等效义务；
   • 履行保留与删除。
3. 共同责任：在事件响应、DPIA与跨境评估方面的协作与证据保存。

十八、加速条款对齐与签约

1. 时间界限：
   • 条款审阅：双方在收到对方红线/修改建议后5个工作日内完成审阅并反馈。
   • 争议项清单：将分歧条款汇总至问题清单，设立技术与法务联合评审，最长不超过10个工作日。
2. 预设基线：
   • 对数据处理、子处理者、保留与删除、审计、安全事件响应、跨境传输（采用SCC/IDTA）等关键条款采用行业基线文本；无法达成一致时，以附录D之标准机制与补充措施为默认落地方案。
3. 升级机制：
   • 若在预设期限内仍有重大分歧，升级至双方指定高管（含隐私/安全负责人）在5个工作日内决策。
4. 签约与生效：
   • 双方同意使用电子签名；在所有关键条款对齐后2个工作日内完成签署。以签署日为生效日或双方另行约定。

十九、终止与退出协助

1. 终止条件：违约、合规风险不可控、监管要求或业务终止。
2. 退出协助：乙方在终止后提供合理的交接与数据返还支持，不得超过约定费用范围。
3. 暂停权：甲方可在发现重大安全或合规风险时暂停数据传输与处理。

二十、责任、赔偿与限制

1. 赔偿：乙方因违反本协议或适用数据保护法规导致甲方发生直接损失（含合理的调查、整改、通知与法律费用）应予以赔偿。
2. 责任限制：除故意不当行为、重大过失、保密义务及数据保护违约、知识产权侵权外，双方累计责任以过去12个月乙方就本服务向甲方收取的费用为上限。
3. 监管罚款：如因乙方过错导致监管罚款，乙方应在法律允许范围内承担相应责任。

二十一、通知与联络

1. 隐私联络：各方指定隐私/数据保护联系人与安全事件通报联系人（姓名、邮箱、电话）。
2. 通知方式：以书面形式（电子邮件或合同系统）发送，重要事件应电话与邮件双渠道通知。

二十二、适用法律与争议解决

1. 适用法律：以甲方注册地之适用法律为准，且不影响适用的数据保护强制性规定。
2. 争议解决：友好协商不成，提交[约定仲裁机构或法院]解决。

签署 甲方（数据控制者）：___________________ 日期：______ 乙方（供应商/处理者）：___________________ 日期：______

附录A：数据清单与共享矩阵

• 数据集与字段：列示各数据类别与具体字段（示例：姓名、邮箱、用户ID、IP、交易ID、事件时间戳等）。
• 处理目的：账户管理、计费、支持服务、分析（限合同目的）、安全监控、欺诈防控。
• 共享频次与方式：API/批量文件/SDK事件；传输协议与加密（TLS1.2+）。
• 接收系统：乙方服务模块、数据仓库（如适用）、日志平台（访问受限）。
• 保留期限：见附录E。

附录B：技术与组织安全措施

• 加密：静态加密（AES-256或等效）、传输加密（TLS1.2+），密钥管理（HSM或等效）。
• 身份与访问：MFA、最小权限、定期访问审计、特权账户管理、会话控制。
• 网络与主机：分段、WAF、端点保护、漏洞扫描与补丁窗口。
• 开发与发布：安全编码规范、依赖库审计、CI/CD合规门禁、渗透测试至少每年一次。
• 日志与监控：集中式日志、不可篡改存储、异常告警、保留与访问控制。
• 数据治理：分类分级、脱敏/伪匿名化、DLP策略。
• 供应链与第三方：安全评估与合同义务传递，安全事件通报。
• 培训与意识：年度隐私与安全培训、专项演练。
• 业务连续性：BCP/DR计划、RTO/RPO指标与测试记录。

附录C：安全事件通报与应急流程

• 通报时间线：初报≤24小时；详报≤72小时。
• 通报内容：事件类型、时间线、影响评估、数据类别、可能风险、措施与改进计划。
• 指挥与协同：甲方主责外部沟通与监管通报；乙方提供技术与证据支持。
• 外部披露：未经甲方书面同意不得对外发布事件信息（法律强制除外）。

附录D：跨境传输与标准合同条款（SCC/IDTA）

• 欧盟SCC：采用2021/914标准条款，模块2（控制者→处理者）或模块3（处理者→处理者），并完成TIA与补充措施。
• 英国传输：采用UK IDTA或欧盟SCC英国附加条款（UK Addendum）。
• 额外控制：端到端加密、访问最小化、司法请求透明度与挑战机制。
• 传输登记：记录数据流向、接收方、法律依据、保护措施与定期复核。

附录E：保留与删除计划

• 一般数据：保留不超过合同目的所需期限，默认不超过24个月；到期删除。
• 安全日志：为审计与安全目的保留不超过12个月（事件调查例外）。
• 计费与合同记录：按法律与财务要求保留（通常7年或当地法规要求），个人数据最小化处理。
• 备份删除：不超过90日循环覆盖。
• 删除证明：含数据集、删除方式与时间戳。

附录F：子处理者清单与管理流程

• 现有清单：列示名称、国家/地区、处理目的、安全资质。
• 准入评估：安全与隐私尽职调查、合同条款传递、跨境机制合规。
• 变更通知：新增或变更至少提前10个工作日通知甲方。

说明

• 本协议为模板，需根据具体服务、数据类型与司法辖区进行定制。
• 所有时间线与阈值可根据风险评估与业务要求调整，但不得低于适用法规要求。