Operator Agreement
This agreement is made between [Responsible party name], registration number [Responsible party registration number], of [Responsible party address] (the "Responsible Party") and [Operator name], registration number [Operator registration number], of [Operator address] (the "Operator"). It starts on [Effective date].
1. Why this agreement exists
1.1 The Operator provides the following services to the Responsible Party: [Services the operator provides]. To do so, it processes personal information on the Responsible Party's behalf. This agreement is the written contract that the Protection of Personal Information Act 4 of 2013 ("POPIA") requires between a responsible party and an operator.
1.2 Words defined in POPIA, such as "personal information", "process" and "data subject", have the same meaning here.
2. What the Operator may do
2.1 The Operator may process the personal information described in the Schedule only on the Responsible Party's documented instructions and only to provide the services. It must not use the information for its own purposes.
2.2 The Operator must treat the personal information as confidential, and must not disclose it unless the Responsible Party authorises it or the law requires it. If the law requires disclosure, the Operator must tell the Responsible Party first where it is lawful to do so.
3. Security
3.1 The Operator must put in place and maintain appropriate, reasonable technical and organisational measures to protect the personal information against loss, damage, unauthorised destruction and unlawful access or processing. This includes measures that are appropriate to the risk and to generally accepted security practice in its industry.
3.2 The Operator must make sure that everyone who has access to the information is under a duty of confidentiality and has been trained on how to handle it.
4. Security compromises
4.1 The Operator must tell the Responsible Party in writing, without delay and in any event within 48 hours, if it knows or has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.
4.2 The notice must describe what happened, what information and how many people may be affected, what the Operator has done, and who to contact. The Operator must help the Responsible Party to investigate, contain and notify the compromise.
5. Other operators (sub-contractors)
5.1 The Operator may use another operator only with the Responsible Party's written permission, which may be general or specific. If it does, it must bind that operator to terms that give at least the same protection as this agreement, and it remains responsible to the Responsible Party for that operator.
6. Requests from people
6.1 If a data subject contacts the Operator about their personal information, the Operator must pass the request to the Responsible Party promptly and must not respond itself unless instructed. The Operator must reasonably help the Responsible Party to respond to requests to access, correct or delete personal information.
7. Sending information outside South Africa
7.1 The Operator must not transfer personal information outside South Africa, or allow access to it from outside South Africa, unless the Responsible Party has agreed in writing and the transfer is allowed by POPIA. Any locations already agreed are recorded in the Schedule.
8. Checking compliance
8.1 The Operator must give the Responsible Party the information it reasonably needs to check that this agreement is being followed, and must allow reasonable audits or reviews on reasonable notice, no more than once a year unless there has been a compromise.
9. Ending the agreement
9.1 When the services end, or earlier if the Responsible Party asks, the Operator must return the personal information to the Responsible Party and then securely delete it, and confirm in writing that it has done so. It may keep copies only if the law requires it to, and those copies stay protected under this agreement.
10. General
10.1 This agreement is part of, and is read together with, the services agreement between the parties. If they conflict about personal information, this agreement wins.
10.2 No change to this agreement is valid unless it is in writing and signed by both parties.
10.3 This agreement is governed by the law of the Republic of South Africa.
Schedule: the personal information
- Services: [Services the operator provides]
- Types of personal information: [Types of personal information]
- Whose information: [Whose information]
- Duration: for as long as the services are provided and until return or deletion under clause 9
For the Responsible Party: [Responsible party name]
Signature: ____________________
Name: ____________________
Title: ____________________
Date: ____________________
For the Operator: [Operator name]
Signature: ____________________
Name: ____________________
Title: ____________________
Date: ____________________