Public document
Data processing addendum
A review schedule for contracts that require documented data-processing terms.
This is an unexecuted review template, not a signed data processing agreement. Party roles and every schedule must be completed and approved for the relevant service.
1. Parties and roles
The executed addendum must identify the customer, the Aussie Websites contracting entity and each party's role for each processing activity. This template does not assume that one role applies to every service.
2. Processing schedule
Before execution, the schedule must state the subject matter, duration, purpose, data categories, people affected, documented instructions and return or deletion requirements.
3. Security and access
The service-specific schedule should reference the production controls that actually apply, including identity and role controls, audit evidence, encryption, backup and restore evidence, vulnerability handling and staff access procedures.
4. Providers and locations
The final subprocessor schedule must name the providers, purpose and processing location verified for the contracted configuration. Optional AI processing must follow the separate in-product disclosure and approval controls.
5. Incidents, requests and end of service
Counsel must approve the cooperation, notification, data-subject request, audit, return, deletion, legal-hold, liability and precedence wording. The operational incident process is documented separately and does not create a contractual notification promise by itself.