Data Processing Agreement

1. Definitions

2. Scope and nature of processing

The Processor will process personal information only as necessary to perform the Engagement described in the services agreement. The scope of processing typically includes:

• Reviewing documentation, policies, and procedures that may reference staff or patient information
• Conducting assessment sessions that may involve discussing information about staff, patients, or third parties
• Accessing system configuration information that may include usernames or identifiers
• Receiving incident details or logs that may contain personal information

The Controller should minimise the personal information shared with the Processor to what is strictly necessary for the Engagement. Where possible, data should be de-identified or anonymised before sharing.

3. Processor obligations

The Processor agrees to:

4. Controller obligations

The Controller agrees to:

• Ensure it has a lawful basis for sharing personal information with the Processor
• Provide clear written instructions for any processing required beyond the scope of the Engagement
• Minimise the personal information shared with the Processor to what is reasonably necessary
• Notify the Processor promptly of any change in instructions that would affect the scope of processing
• Comply with all obligations applicable to it as Controller under the Privacy Act and APPs
• Ensure individuals whose personal information is shared have been notified of such sharing to the extent required by law

5. Security measures

The Processor implements reasonable technical and organisational measures to protect personal information against misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

6. Sub-processors

The Processor uses the following sub-processors in connection with service delivery. The Controller provides general authorisation for their use by entering into an engagement with the Processor.

The Processor will notify the Controller of any intended change to sub-processors and provide the Controller a reasonable opportunity to object before the change takes effect.

7. Data retention and return

Upon completion or termination of the Engagement:

• The Processor will, at the Controller's written request, return or securely delete all personal information provided by the Controller.
• Where no written request is received within 30 days of Engagement completion, the Processor will retain personal information for 7 years to meet standard business record-keeping obligations, then securely delete it.
• The Processor may retain personal information where required to do so by law, for the period required by that law.
• The Processor will certify deletion in writing upon request.

8. Data breach notification

If the Processor becomes aware of a data breach affecting personal information held on behalf of the Controller, the Processor will:

The obligation to notify does not require the Processor to make notifications directly to the OAIC or affected individuals — that remains the Controller's responsibility unless otherwise agreed in writing.

9. Compliance with the Privacy Act

The Processor maintains its own privacy obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the Processor collects personal information on behalf of the Controller, the Processor will handle that information in accordance with:

• The Privacy Act 1988 (Cth) and Australian Privacy Principles
• The Privacy & Other Legislation Amendment Act 2024 (Cth)
• Any specific obligations applicable to the nature of the Engagement
• This Agreement

10. Audit rights

The Controller may, on reasonable written notice (at least 14 days), request that the Processor:

• Provide documentation evidencing compliance with this Agreement
• Respond to reasonable written questions about its data handling practices
• Facilitate a review of relevant security and privacy practices

Audit activities must be conducted in a way that minimises disruption to the Processor's operations. The Controller bears the costs of any audit it requests. Audits are limited to once per year unless there are reasonable grounds to believe a breach has occurred.

11. Liability and indemnification

Each party is liable to the other for any loss or damage caused by its breach of this Agreement or the Privacy Act, subject to the limitations set out in the services engagement agreement.

The Processor will not be liable for any loss or damage arising from:

• Processing carried out in accordance with the Controller's documented instructions
• Failures or breaches attributable to the Controller's own systems or actions
• Events beyond the Processor's reasonable control

Nothing in this clause limits either party's liability for fraud, wilful misconduct, or any liability that cannot be excluded by law.

12. Term and termination

This Agreement commences on the date the parties enter into the services engagement agreement and continues until all personal information shared under the Engagement has been returned or deleted in accordance with clause 7.

Termination of the services engagement agreement does not affect the obligations under this Agreement in respect of personal information already processed.

13. Governing law

This Agreement is governed by the laws of South Australia and the Commonwealth of Australia. Any disputes are subject to the exclusive jurisdiction of the courts of South Australia.

14. Contact

For questions about this Agreement or data processing matters, contact the Processor: