This precedent is for use between a Processor and sub-processor and assumes the customer (as the original processor) is seeking to flow down terms agreed with a controller entity based on Precedent: UK GDPR and EU GDPR—combined Personal data Processing schedule—pro-controller.

For a list of precedent provisions for use between a controller and processor, see: List of Data protection clauses and agreements for commercial transactions and personal data processing and sharing.

This precedent uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Customer’, ‘Services’, ‘Supplier’ and ‘Supplier Personnel’, which are unlikely to be specific to this schedule and which it is assumed are separately defined in the relevant agreement.

The Schedule

Part A: Operative provisions

1. 1. 1

      Definitions

      1. 1.1

         In this Schedule:

         Applicable EEA Law

         1. •

            means all applicable law(s) of the European Economic Area and European Union and of the relevant member state(s) of either;

         Applicable UK Law

         1. •

            means all applicable law(s) of the United Kingdom (or of any part of the United Kingdom);

         Controller

         1. •

            has the meaning given in applicable Data Protection Laws from time to time;

         Controller Entity

         1. •

            means