Google Cloud Platform, Workspace, Cloud Identity & Implementation Services: EU Model Contract Clauses (Controller-to-Processor) - UK
Standard Contractual Clauses (processors) for the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processor established in third countries which do not ensure an adequate level of data protection Customer (the “Data Exporter”) and Google (the “Data Importer”) each a “party”; together “the parties”, HAVE AGREED on the following Contractual Clauses (the “Clauses”) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the Data Exporter to the Data Importer of the personal data specified in Appendix 1.
The parties agree that execution of the Agreement and certification by the Data Exporter in relation to Google Cloud Platform, Google Workspace or Cloud Identity under Section 10.4 of the Data Processing and Security Terms at https://cloud.google.com/terms/data-processing-terms (“DPST (Customers)”), the Data Processing and Security Terms at https://cloud.google.com/terms/data-processing-terms/partner) (“DPST (Partners)”) or the Data Processing Amendment at https://cloud.google.com/terms/data-processing-terms (“DPA”), as applicable, shall constitute execution of the Clauses by both parties.
Capitalized terms used but not defined in the Clauses (including the Appendices) have the meanings given to them in the agreement into which the Clauses are incorporated (the "Agreement"). If the Agreement relates to the resale or supply of Google Cloud Platform under a Google Cloud partner or reseller program, then all references in the Clauses to Customer mean Partner.
Clause 1
**Definitions **
For the purposes of the Clauses:
(a) ‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’, ‘Data Subject’ and ‘Supervisory Authority’ shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
(b) ‘the Data Exporter’ means the controller who transfers the personal data;
(c) ‘the Data Importer’ means the processor who agrees to receive from the Data Exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25 (1) of Directive 95/46/EC;
(d) ‘the Subprocessor’ means any processor engaged by the Data Importer or by any other subprocessor of the Data Importer who agrees to receive from the Data Importer or from any other subprocessor of the Data Importer personal data exclusively intended for processing activities to be carried out on behalf of the Data Exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
(e) ‘the applicable data protection law’ means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the Data Exporter is established;
(f) ‘technical and organisational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.