feat: Add Data Processing Agreement (DPA) template for TeachLink Web …

Governance/compliance/DPA_TEMPLATE.md

@@ -0,0 +1,294 @@
+# Data Processing Agreement (DPA) Template
+
+## Purpose
+
+This Data Processing Agreement (DPA) template provides a versioned reference for data processing activities within the TeachLink Web project. It outlines the roles, responsibilities, and obligations of the data controller and data processor, ensuring compliance with applicable data protection laws including but not limited to GDPR, CCPA, and other relevant privacy regulations.
+
+This document serves as a governance artifact to close the gap identified in the TeachLink Web governance framework and provides a clear, versioned reference for contributors and maintainers regarding data processing practices.
+
+## Parties
+
+| Role | Description | Contact |
+|------|-------------|---------|
+| **Data Controller** | The entity determining the purposes and means of the processing of personal data. | [To be filled] |
+| **Data Processor** | The entity processing personal data on behalf of the data controller. | [To be filled] |
+
+## Effective Date
+
+[To be filled, e.g., 2026-01-15]
+
+## Version
+
+1.0.0
+
+## Article 1: Scope of Processing
+
+### 1.1 Categories of Personal Data
+
+The following categories of personal data may be processed under this Agreement:
+
+- [ ] Name and contact information
+- [ ] Email address
+- [ ] Phone number
+- [ ] Institutional affiliation
+- [ ] Role/title within institution
+- [ ] Course enrollment data
+- [ ] Assessment and performance data
+- [ ] Demographics (age, gender, location - if collected)
+- [ ] Special category data (if applicable, with explicit consent)
+
+### 1.2 Processing Activities
+
+The Processor may perform the following processing activities on behalf of the Controller:
+
+- [ ] Storage of personal data
+- [ ] Transmission of personal data
+- [ ] Transformation or aggregation of personal data
+- [ ] Analysis of personal data
+- [ ] Deletion or anonymization of personal data
+- [ ] Other: [To be specified]
+
+### 1.3 Jurisdiction
+
+This Agreement applies to personal data processed in accordance with the following jurisdictions' laws:
+- European Union (GDPR)
+- United States (CCPA/CPRA)
+- Other: [To be specified]
+
+## Article 2: Subprocessing
+
+### 2.1 Authorized Subprocessors
+
+The Processor shall not engage any subprocessor without prior written authorization from the Controller. However, the Processor may engage subprocessors for the following categories of processing activities listed in Article 1, provided that:
+
+1. The subprocessor is located in a country that provides an adequate level of data protection as determined by the European Commission, or appropriate safeguards are in place, or
+2. The subprocessor is bound by a written contract with the Processor that includes obligations no less protective than those set out in this Agreement.
+
+### 2.2 Subprocessor List
+
+The current list of authorized subprocessors is maintained below and updated as needed:
+
+| Subprocessor | Purpose | Jurisdiction | Security Measures |
+|-------------|---------|-------------|-------------------|
+| [To be filled] | [To be filled] | [To be filled] | [To be filled] |
+
+### 2.3 Notification of Changes
+
+The Processor shall notify the Controller in writing of any intended change in subprocessing, including the identity of the new subprocessor and the nature of the processing to be undertaken, at least [30] days before the change takes effect.
+
+### 2.4 Controller's Right to Object
+
+The Controller may object to the engagement of a new subprocessor within [30] days of receiving the notification. Objection shall be documented and the Processor shall not engage the subprocessor unless the objection is resolved.
+
+## Article 3: Obligations of the Parties
+
+### 3.1 Controller Obligations
+
+The Controller shall:
+
+- Provide all necessary information to enable the Processor to fulfil its obligations under this Agreement and under applicable data protection law
+- Ensure that the processing of personal data is lawful based on valid legal grounds (e.g., consent, contract, legal obligation)
+- Provide access to data subjects exercising their rights under applicable law
+- Not instruct the Processor to process personal data in violation of applicable law or this Agreement
+
+### 3.2 Processor Obligations
+
+The Processor shall:
+
+- Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation
+- Ensure that persons who have access to personal data are subject to adequate confidentiality obligations
+- Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including but not limited to:
+  - Encryption of personal data at rest and in transit
+  - Pseudonymisation and/or anonymisation where appropriate
+  - Ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
+  - Process for restoring the availability of personal data in a timely manner in the event of a technical incident
+  - Process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring security
+- Only engage subprocessors meeting the requirements of Article 2
+- Assist the Controller in ensuring compliance with the data subject's rights under applicable law, including the right to:
+  - Receive confirmation as to whether or not personal data concerning him or her has been processed
+  - Receive communication in an intelligible form of all personal data concerning his or her having been processed
+  - Rectification of inaccurate personal data
+  - Erasure of personal data
+  - Restriction of processing
+  - Data portability
+  - Opposition to processing
+- Delete or return all personal data to the Controller as requested by the Controller at the end of the period for which the personal data is to be processed
+- Provide the Controller with reasonable assistance to enable the Controller to fulfil its obligation to notify data subjects and supervisory authorities of a personal data breach
+- Notify the Controller without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach
+- Make available to the Controller all information necessary to demonstrate compliance with this Agreement and with applicable data protection law
+- Allow the Controller, or a third party authorised by the Controller, to conduct or commission audits or inspections, including any appropriate technical measures, in order to verify compliance with this Agreement
+
+## Article 4: International Data Transfers
+
+### 4.1 Transfer Restrictions
+
+The Processor shall not transfer personal data to a third country or international organisation unless:
+
+1. The Controller has prior written authorisation, or
+2. The transfer is subject to appropriate safeguards, including but not limited to:
+   - An adequacy decision by the European Commission
+   - Binding corporate rules
+   - Standard data protection clauses approved by the European Commission
+   - Certified Data Privacy Framework under the EU-US Data Privacy Framework
+   - Other legally recognized transfer mechanism
+
+### 4.2 Standard Contractual Clauses
+
+Where standard contractual clauses are used, the parties shall adhere to the European Commission's approved clauses and any applicable guidance or amendments thereto.
+
+### 4.3 United States transfers
+
+Any transfer of personal data to the United States shall be subject to the EU-US Data Privacy Framework or other appropriate safeguards as described in Article 4.1.
+
+## Article 5: Data Subject Rights
+
+The Processor shall assist the Controller in ensuring the following data subject rights can be exercised:
+
+- Right to be informed
+- Right of access
+- Right to rectification
+- Right to erasure ("right to be forgotten")
+- Right to restrict processing
+- Right to data portability
+- Right to object
+- Rights related to automated decision-making and profiling
+
+The Processor shall implement processes and technical measures to enable the timely fulfillment of data subject requests within the timeframes prescribed by applicable law (typically within one month of receipt).
+
+## Article 6: Security Measures
+
+### 6.1 Technical Measures
+
+The Processor shall implement appropriate technical measures including, at minimum:
+
+- Encryption of personal data stored on media
+- Secure transmission of personal data using TLS/SSL or equivalent
+- Access controls and authentication mechanisms
+- Audit logging of access to personal data
+- Regular security updates and patch management
+- Vulnerability scanning and penetration testing
+
+### 6.2 Organisational Measures
+
+The Processor shall implement appropriate organisational measures including, at minimum:
+
+- Confidentiality agreements with all personnel having access to personal data
+- Staff training on data protection and security practices
+- Clear desk and screen policy for facilities processing personal data
+- Incident response plan for data breaches
+- Record-keeping of processing activities
+
+## Article 7: Duration and Termination
+
+### 7.1 Term
+
+This Agreement shall commence on the Effective Date and continue for the duration of the relationship between the Controller and Processor, unless terminated earlier pursuant to the terms herein.
+
+### 7.2 Termination for Convenience
+
+Either party may terminate this Agreement upon [30] days' written notice for convenience.
+
+### 7.3 Termination for Cause
+
+Either party may terminate this Agreement immediately upon written notice if the other party materially breaches any provision of this Agreement and fails to cure such breach within [30] days of receiving written notice thereof.
+
+### 7.4 Post-Termination Obligations
+
+Upon termination or expiration of this Agreement, the Processor shall:
+
+- Delete all personal data received from the Controller or created on behalf of the Controller, except where retention is required by applicable law
+- Return all personal data to the Controller upon request
+- Provide the Controller with written confirmation of deletion or return within [30] days of termination
+- Continue to comply with Articles 3, 4, 5, 6, and 9 for a period of [3] years following termination in respect of personal data that was processed prior to termination
+
+## Article 8: Data Breach Notification
+
+### 8.1 Processor to Controller Notification
+
+The Processor shall notify the Controller without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, providing:
+
+- Nature of the breach including, where possible, the categories and approximate number of data subjects and personal records concerned
+- Contact details of the data protection officer or other point of contact where more information can be obtained
+- Consequences of the breach
+- Measures taken or proposed to address the breach, including measures to mitigate potential adverse effects
+
+### 8.2 Controller to Data Subject Notification
+
+The Controller shall be responsible for noticking data subjects and supervisory authorities in accordance with applicable law. The Processor shall provide reasonable assistance as requested by the Controller.
+
+## Article 9: Liability and Indemnification
+
+### 9.1 Liability
+
+Each party shall be liable for its own acts or omissions in connection with the performance of this Agreement in accordance with applicable law.
+
+### 9.2 Indemnification
+
+The Processor shall indemnify and hold harmless the Controller against any and all claims, damages, losses, and expenses (including reasonable legal fees) arising out of or related to the Processor's breach of this Agreement or applicable data protection law.
+
+## Article 10: Governing Law and Dispute Resolution
+
+This Agreement shall be governed by and construed in accordance with the laws of [Jurisdiction], without regard to its conflict of law provisions. Any dispute arising out of or relating to this Agreement shall be resolved exclusively by the courts of [Jurisdiction].
+
+## Article 11: Miscellaneous
+
+### 11.1 Amendments
+
+This Agreement may only be amended by a written agreement signed by authorized representatives of both parties.
+
+### 11.2 Severability
+
+If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
+
+### 11.3 Entire Agreement
+
+This Agreement constitutes the entire understanding between the parties with respect to the subject matter hereof and supersedes all prior agreements, understandings, and communications, whether written or oral, relating to such subject matter.
+
+### 11.4 Notices
+
+All notices under this Agreement shall be in writing and delivered to the parties at their respective addresses set forth in the signature block below, or such other address as a party may designate by notice pursuant hereto.
+
+### 11.5 Assignment
+
+Neither party may assign or otherwise transfer this Agreement or any of its rights or obligations hereunder without the prior written consent of the other party, except that either party may assign this Agreement to its successor by merger, consolidation, or sale of all or substantially all of its assets.
+
+## Signature Block
+
+**Data Controller**
+
+Name: ___________________________
+
+Title: ___________________________
+
+Signature: _______________________
+
+Date: ___________________________
+
+**Data Processor**
+
+Name: ___________________________
+
+Title: ___________________________
+
+Signature: _______________________
+
+Date: ___________________________
+
+## Change Log
+
+| Date       | Version | Author              | Description                                                                 |
+|------------|---------|---------------------|--------------------------------------------------------------------------------------|
+| [Date]     | 1.0.0   | [Author]            | Initial DPA template added to close governance gap in the Governance/compliance folder. |
+
+## Regression Testing
+
+Where applicable, the following tests should be maintained to verify DPA compliance features:
+
+- **Subprocessor change tests**: Verify that any changes to subprocessors are documented and Controller approval is obtained
+- **Data breach simulation tests**: Test the notification process and timelines for data breach reporting
+- **Data subject request tests**: Verify that processes are in place to handle data subject rights requests within required timeframes
+- **Security measure audits**: Regular audits of technical and organisational security measures
+- **Version compatibility tests**: Ensure that DPA version aligns with corresponding privacy policy and terms of service versions
+
+---
+*This template is a governance document and does not constitute legal advice. Maintainers should consult qualified legal counsel before relying on this template for actual data processing arrangements.*