Data Security Agreement

Disclosing Party: [Company Name] · Receiving Party: [Vendor/Partner Name] · Date: [Date]

1. Scope

This Agreement establishes the security requirements Receiving Party must follow when accessing, processing, or storing Disclosing Party's data ("Company Data") in connection with [the underlying services agreement].

2. Security Standards

Receiving Party will maintain administrative, technical, and physical safeguards for Company Data, including: [encryption of data at rest and in transit, access controls limiting data access to personnel with a legitimate need, regular security patching, and multi-factor authentication for systems storing Company Data].

3. Subcontractors/Subprocessors

Receiving Party will not share Company Data with any subcontractor without Disclosing Party's prior written consent, and any approved subcontractor must be bound by security terms at least as protective as this Agreement.

4. Security Assessments

Disclosing Party may request [an annual security questionnaire / a SOC 2 report or equivalent / the right to audit] Receiving Party's security practices related to Company Data.

5. Breach Notification

Receiving Party will notify Disclosing Party within [Timeframe, e.g. 24-72 hours] of discovering any unauthorized access, use, or disclosure of Company Data, and will cooperate with any resulting investigation.

6. Data Return or Destruction

Upon termination of the underlying relationship, Receiving Party will [return/securely destroy] all Company Data, confirming completion in writing within [Timeframe].

7. Liability

[State any specific liability terms related to a data breach, which may include a carve-out from a general liability cap given the severity of data breach risk.]

Disclosing Party: ______________________ Date: ____________ Receiving Party: ______________________ Date: ____________

*A fast breach notification deadline (Section 5, often 24-72 hours) matters more than it might seem — many data breach laws start the clock on a company's own legal notification obligations to regulators and affected individuals from when it "knew or should have known," so a vendor's delay in reporting can directly cause the company to miss its own compliance deadline.*