Data Processing Addendum (Australia)

1. Background

This Addendum forms part of the Service Agreement between the parties and governs the processing of Personal Information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies where the Processor handles Personal Information on behalf of the Controller.

2. Definitions

• Personal Information: As defined in the Privacy Act 1988 (Cth).
• Processing: Any operation performed on Personal Information, including collection, storage, use, disclosure, or destruction.
• Controller: The entity determining the purposes and means of processing Personal Information.
• Processor: The entity processing Personal Information on behalf of the Controller.
• Privacy Laws: The Privacy Act 1988 (Cth), APPs, and any applicable state/territory privacy laws.
• Eligible Data Breach: As defined under Part IIIC of the Privacy Act (NDB scheme).

3. Scope and Purpose

The Processor will process Personal Information solely for the purpose of delivering the Services under the main agreement and in accordance with the Controller's documented instructions.

4. Processor Obligations

The Processor shall comply with the Privacy Act 1988 (Cth) and APPs, implement reasonable security measures, ensure confidentiality, and maintain records of processing activities where required by law. The Processor engages only the sub-processors on its published Sub-Processor List, and will give the Controller at least 14 days’ notice before adding a new one, during which the Controller may object.

5. Data Location & Subprocessors

• Hosting region: Application hosting, databases and scan data storage are in Australia (Sydney).
• Sub-processors: As listed on the Sub-Processor List, with the purpose, data categories and processing location of each.

6. Cross-Border Transfers

Some sub-processors process specific Personal Information outside Australia, including in the United States and, for partner-delivered services (penetration testing, dark web monitoring, and social engineering assessment and training), in South Africa, where the Protection of Personal Information Act 2013 (POPIA) also applies. The Controller consents to the transfers described on the Sub-Processor List. For each, the Processor takes reasonable steps, including contractual terms, to ensure the recipient does not breach the APPs, and remains accountable for the recipient’s handling as the APPs require. The Processor will not make any other transfer outside Australia without the Controller’s consent.

6A. Microsoft 365 Administration

This clause applies where the Controller engages the Processor’s Microsoft 365 Managed Security Service.

• Access: the Processor accesses the Controller’s Microsoft 365 only through Microsoft’s granular delegated admin privileges (GDAP), approved by a Global Administrator of the Controller. The Processor requests only the roles the engaged services need and does not request the Global Administrator role.
• Approval of changes: the Processor makes changes in the Controller’s Microsoft 365 only with the Controller’s prior approval in writing, given by email from an authorised contact or through a request in the Processor’s portal. The Processor keeps a record of each approval for the term of the agreement.
• Use of access: the Processor uses the access only to deliver the engaged services, and does not open or copy email or file content except where a task the Controller has asked for requires it.
• Duration: each admin relationship has an end date. The Processor does not extend a relationship automatically; it asks the Controller to approve a renewal before the relationship expires.
• Ending access: the Controller may remove the Processor’s roles at any time from Partner relationships in the Microsoft 365 admin center. When the service ends, the Processor removes its roles within 2 business days.
• Processor accounts: all Processor accounts used for this access are protected by multi-factor authentication.

7. Security Measures

The Processor will implement technical and organisational measures, including encryption, access controls, and regular vulnerability assessments.

8. Notifiable Data Breaches

The Processor will notify the Controller as soon as practicable upon becoming aware of an Eligible Data Breach and assist with OAIC notifications within statutory timelines.

9. Assistance with Privacy Rights

The Processor will assist the Controller in responding to requests for access, correction, or deletion of Personal Information under APPs.

10. Audit & Compliance

The Controller may request reasonable information to verify compliance. The Processor will cooperate with audits or inspections as required by law.

11. Termination & Data Return

Upon termination of the main agreement, the Processor will delete or return all Personal Information to the Controller, unless retention is required by law.

12. Liability

Each party remains responsible for its own compliance with Privacy Laws. The Processor's liability is limited as per the main agreement, subject to non-excludable rights under the Australian Consumer Law.

13. Governing Law

This Addendum is governed by the laws of Queensland, Australia, and the parties submit to the exclusive jurisdiction of its courts.