Data Processing Addendum (DPA)
Draft – For Legal Review  
Governing Law: South Australia, Australia

1. Purpose
This Data Processing Addendum (“DPA”) forms part of the Software Supply Agreement (“Agreement”) between the Supplier and the Customer. It governs the processing of Personal Information by the Supplier on behalf of the Customer.

2. Definitions
“Personal Information” has the meaning in the Privacy Act 1988 (Cth).

“Customer Data” means data provided or made available by the Customer.

“Processing” means any operation performed on Personal Information.

“Sub‑processor” means any third party engaged by the Supplier to process Personal Information.

3. Roles
3.1 The Customer is the data controller.
3.2 The Supplier is the data processor.

4. Supplier Obligations
4.1 Process Personal Information only on documented instructions from the Customer.
4.2 Implement reasonable technical and organisational security measures aligned to the ISM and Essential Eight maturity targets.
4.3 Ensure personnel are subject to confidentiality obligations.
4.4 Notify the Customer of any data breach as soon as practicable.
4.5 Assist the Customer with responding to privacy requests and regulatory enquiries.

5. Sub‑processors
5.1 The Supplier may engage Sub‑processors for hosting, analytics, or support.
5.2 The Supplier must ensure Sub‑processors are bound by equivalent privacy and security obligations.
5.3 The Supplier will provide a list of Sub‑processors on request.

6. International Transfers
Where Personal Information is stored or processed overseas, the Supplier will take reasonable steps to ensure compliance with the Australian Privacy Principles (APPs).

7. Customer Obligations
7.1 Ensure lawful collection of Personal Information.
7.2 Provide accurate and up‑to‑date instructions.
7.3 Maintain appropriate internal security controls.

8. Data Breach
The Supplier will notify the Customer of any eligible data breach under the Notifiable Data Breaches (NDB) scheme.

9. Return or Deletion of Data
Upon termination, the Supplier will delete or return Customer Data as instructed, unless retention is required by law.

10. Governing Law
South Australia.