Data Processing Agreement
Last updated:
Draft text under legal review. It is not yet available for signature and does not describe a signed agreement.
1. Parties and scope
This Data Processing Agreement ("DPA") forms part of the service terms between the customer ("Controller") and the AWstreams product entity named in the order ("Processor"). It applies to personal data the Processor handles on the Controller's behalf when the Controller uses the product.
2. Processing on instructions
The Processor processes personal data only on the Controller's documented instructions (the service terms, the product settings and this DPA), and tells the Controller if it believes an instruction breaches applicable data-protection law.
3. Confidentiality and security
Personnel with access are bound by confidentiality. The Processor keeps technical and organisational measures appropriate to the risk, including encryption in transit and at rest for backups, role-based access, audit logging and tested restores.
4. Sub-processors
The Controller gives general authorisation to the sub-processors listed on the sub-processors page. The Processor updates that page and notifies subscribers before adding or replacing one, and the Controller may object on reasonable data-protection grounds within the notice period. The Processor stays liable for its sub-processors and flows down equivalent obligations.
5. Assistance and data-subject rights
The Processor helps the Controller answer data-subject requests (access, correction, deletion, portability, objection) and carry out impact assessments, using the product tools or on written request.
6. Personal-data breach
The Processor notifies the Controller without undue delay and in any case within 48 hours of becoming aware of a breach affecting the Controller's data, with the facts needed to meet the Controller's own deadlines (72 hours in Saudi Arabia, Egypt and ADGM; immediately in the UAE federal regime where it applies; 3 days to data subjects in Egypt).
7. International transfers
Transfers of personal data outside the Controller's country take place only under a lawful mechanism: the annex for the Controller's jurisdiction (A: Saudi Arabia, B: UAE, C: Egypt). The mechanism for each sub-processor is shown on the sub-processors page.
8. Return and deletion
On termination the Processor returns or deletes the Controller's personal data within 30 days of the Controller's request, except where law requires retention. Backups age out on their normal cycle.
9. Audit
The Processor provides information needed to show compliance and allows reasonable audits on 30 days' notice, normally satisfied by its security evidence pack and independent test reports.
Annex A. Saudi Arabia: SDAIA standard contractual clauses
Where personal data is transferred out of the Kingdom of Saudi Arabia, the SDAIA standard contractual clauses under the Personal Data Protection Law and its Regulation on Personal Data Transfers Outside the Kingdom are incorporated by reference. The official SDAIA text, unmodified, is attached at signing.
Parties and roles: Controller as data exporter, Processor as data importer [per order]. Transfer details: categories of data subjects and data, purposes, recipients and retention are those in the order and on the sub-processors page. Competent authority: SDAIA. Governing law and forum: the Kingdom of Saudi Arabia, unless the SDAIA clauses require otherwise.
Annex B. United Arab Emirates
Applies where the Controller is established in the UAE. Processing follows Federal Decree-Law 45 of 2021 (PDPL) and, for health data, Federal Law 2 of 2019 and Ministerial Decision 51 of 2021. Health data stays in the UAE unless an exemption or the Controller's documented consent applies [confirm per customer]. Free-zone customers (DIFC, ADGM) follow their own data-protection regulations where they apply. Breach notice: see clause 6.
Annex C. Arab Republic of Egypt
Applies where the Controller is established in Egypt. Processing follows Law 151 of 2020 on the Protection of Personal Data and its executive regulation. Cross-border transfer requires the licence or permit of the Personal Data Protection Centre where the law demands it [confirm per customer]. The Processor supports the Controller's Data Protection Officer and the 3-day notice to data subjects after a breach.
Request a signed copy
Need a countersigned copy for your procurement file? Write to us and name your company and country.