Snapshot 35079
Normalized text
Scripts and page chrome removed; this is what change detection compares.
THOMSON REUTERS DATA PROCESSING
ADDENDUM
Version 3
Effective 1, February 2025
This DPA shall be effective for all contracts and renewals entered into on or after February 1,
2025.
This Data Processing Addendum (“DPA”) is incorporated into the Agreement between Thomson
Reuters and Customer and sets out the obligations of both parties with respect to the Processing
of Customer Personal Data in connection with the Agreement. Unless otherwise defined herein,
any capitalized terms shall have the meanings given to them in the Agreement or in Applicable
Data Protection Law.
1. DEFINED TERMS. The following terms shall have the following meanings in this DPA:
1.1. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under
common control with the subject entity. “Control,” for purposes of this definition, means
direct or indirect ownership or control of more than 50% of the voting interests of the
subject entity;
1.2. “Agreement” means the underlying agreement between Thomson Reuters and Customer
for the provision of the Services that references and incorporates this DPA;
1.3. “Applicable Data Protection Law” means data privacy and cybersecurity laws to the
extent applicable to the relevant party’s Processing of Customer Personal Data, which may
include: (a) the General Data Protection Regulation (Regulation (EU) 2016/679) (and any
national implementing laws, regulations and secondary legislation, as amended, updated or
replaced from time to time); and/or (b) the California Consumer Privacy Act of 2018 as set
forth in Cal. Civ. Code § 1798.100 et seq. (and as amended by the California Privacy Rights
Act of 2020, together with the regulations promulgated pursuant thereto), in each case as
amended from time to time;
1.4. “Authorized Affiliate” means any of Customer’s Affiliate(s) which (a) is subject to
Applicable Data Protection Law, and (b) is permitted to use the Services pursuant to the
Agreement between Customer and Thomson Reuters, but has not signed its own Agreement
or Order Form with Thomson Reuters and is, therefore, not a “Customer” as defined under
this DPA;
1.5. “Customer” means the legal entity which has directly entered into the Agreement for
Services with Thomson Reuters or its Affiliates;
1.6. “Customer Personal Data” means the Personal Data that Customer or its Authorized
Affiliate provides under the Agreement for Thomson Reuters to Process on behalf of
Customer in connection with the Services. Customer Personal Data does not include
information that is (i) deidentified, anonymized, aggregated, publicly available information,
or business contact data (unless the Applicable Data Protection Law otherwise considers such
information as Personal Data), (ii) Usage Statistics; or (iii) any information that the
Applicable Data Protection Law specifically states does not constitute Personal Data;
1.7. “Data Security Addendum” means either (a) the Thomson Reuters Data Security
Addendum set forth at tr.com/trdsa, or (b) if applicable, a negotiated data security addendum
that is incorporated into the Agreement by the parties, in each case as it may now or hereafter
be amended;
1.8. “Data Privacy Framework” or “DPF” means the EU-U.S. Data Privacy Framework (EU-
U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to
the EU-U.S. DPF), and the Swiss-
U.S. Data Privacy Framework (Swiss-U.S. DPF) developed to facilitate transatlantic
commerce by providing reliable mechanisms for personal data transfers to the United States
from the European Union and European Economic Area, the United Kingdom (and
Gibraltar), and Switzerland that are consistent with EU, UK, and Swiss law;
1.9. “DPF Principles” means the binding set of requirements that govern DPF-participating
organizations’ use and treatment of Personal Data received from the EU/UK or Switzerland
under, respectively, the EU-U.S. Data Privacy Framework Principles (which apply to the
EU- U.S. DPF and the UK Extension to the EU-U.S. DPF) and the Swiss-U.S. Data Privacy
Framework Principles (which apply to the Swiss-U.S. DPF);
1.10. “Security Breach” shall have the meaning ascribed to it in the Data Security Addendum;
1.11. “Services” means the products or services provided by Thomson Reuters to Customer
pursuant to the Agreement;
1.12. “Standard Contractual Clauses” means those model clauses approved pursuant to
Applicable Data Protection Law that legitimizes the transfer of Personal Data across
borders, including the Standard Contractual Clauses approved by the European
Commission which can be found here;
1.13. “Subprocessor” means a subcontractor used by Thomson Reuters to provide Services,
where such subcontractor Processes Customer Personal Data;
1.14. “Thomson Reuters” means the named Thomson Reuters entity that has entered into the
Agreement for Services with Customer;
1.15. “Transfer” means the international transfer of Customer Personal Data;
1.16. “Usage Statistics” means information that is generated by or on behalf of Thomson Reuters
and is derived by or through the use of the Services; and
1.17. “Controller” also referred to as “Business”, “Processor” also referred to as “Service
Provider”, “Data Subject” also referred to as “Consumer”, “Personal Data” also referred
to as “Personal Information”, “Process” or “Processing”, and “Sell” or “Selling” (or any
of their analogous terms) shall all have the meanings set out in the relevant Applicable Data
Protection Law.
2. PROCESSING OF CUSTOMER PERSONAL DATA AND PARTIES’ OBLIGATIONS.
2.1. Compliance with Laws. Each party agrees to comply with its own obligations under
Applicable Data Protection Laws.
2.2. Parties’ Obligations. With respect to the Processing of Customer Personal Data in
connection with the Services, the parties agree that:
2.2.1. Customer is the Controller of Customer Personal Data and, consequently, Thomson
Reuters is a Processor thereof, in which the parties agree that the Customer Personal
Data is being disclosed to Thomson Reuters only for such limited and specified
purposes as described in Customer’s instructions, including the purpose of Processing
and Processing activities as set forth in the Agreement;
2.2.2. Each party will (i) inform the other if, in its reasonable opinion, an instruction infringes
on its own obligations under Applicable Data Protection Law or other laws and (ii)
upon reasonable request, provide assistance required under Applicable Data Protection
Law with respect to data protection impact assessments, consulting with relevant data
protection authorities, and/or making available relevant information necessary to
demonstrate compliance with Applicable Data Protection Law;
2.2.3. Without limiting Section 2.1, Customer represents and warrants that it has obtained all
consents for and rights to, and has provided all necessary notices to Data Subjects with
respect to, the Customer Personal Data as required for the same to be Processed as
contemplated by the Agreement; and
2.2.4. Except as required under Applicable Data Protection Law, Customer acknowledges
and agrees that Thomson Reuters is under no duty to independently collect consent
from or provide notice to any Data Subjects or to investigate the completeness,
accuracy, or sufficiency of any specific Customer instruction or Customer Personal
Data.
3. OBLIGATIONS OF THOMSON REUTERS. Thomson Reuters will take steps to ensure that:
3.1. Limitations on Processing. It only Processes the Customer Personal Data hereunder in
alignment with Customer’s instructions, including those set forth in the Agreement;
3.2. Personnel. Its personnel (including staff, agents, and Subprocessors) who handle Customer
Personal Data are subject to a duty of confidentiality;
3.3. Security. It maintains and implements appropriate technical and organisational measures
designed to protect Customer Personal Data against unauthorized destruction, loss,
alteration, disclosure thereof, or access thereto. The parties agree that the security measures
set forth on the Data Security Addendum are in scope and fulfill the obligations of this
Section;
3.4. Access Requests. It will provide reasonable cooperation to Customer or a Data Subject to
fulfil a Data Subject’s request to access, correct, delete, or cease processing of Personal
Data. To the extent Thomson Reuters receives a request, correspondence, enquiry, or
complaint from a regulator that directly relates to Customer Personal Data, then (to the
extent permissible) it will promptly refer the same to Customer for handling;
3.5. Breach Notification. It will report a Security Breach as required and in accordance with
Section 4 of the Data Security Addendum, including that, to the extent known, it shall
provide relevant information and reasonable cooperation so that Customer can fulfil its own
obligations as Controller. The obligations herein shall not apply to incidents that are caused
by Customer or Customer’s users;
3.6. Deletion and Retention. Upon request, it will delete the Customer Personal Data in its (or its
Subprocessors’) possession, except to the extent that Thomson Reuters is required to retain
such data by law or its data retention policies (in which case Thomson Reuters shall isolate
and protect such Customer Personal Data from further active Processing except to the extent
required by law);
3.7. Subprocessors. It will impose written data protection terms on any Subprocessor that are
no less restrictive than the terms of this DPA; remain primarily liable for acts or omissions
of its Subprocessor in the same manner as for its own acts or omissions under the
Agreement, in which Customer hereby (a) provides its general authorization for Thomson
Reuters to engage Subprocessors to carry out its obligations under the Agreement; and (b)
agrees that Thomson Reuters does not provide tailor-made services and, therefore, the
Services and related Personal Data protection solutions and operations, including
engagement of any Subprocessor by Thomson Reuters, are offered “as is”;
3.7.1. Updates and Objection. Thomson Reuters’ Subprocessors, and updates thereof, can
be found on its webpages here or in other notices provided from time to time. Thomson
Reuters will provide Customer the opportunity to reasonably object to the appointment
or replacement of a Subprocessor. To the extent reasonable, Thomson Reuters will
either give Customer an opportunity to pay for the Service without use of the
objectionable Subprocessor or terminate, subject to the terms of the Agreement, the
specific Service(s) affected by the Subprocessor at issue; and
3.8. Audits. It will allow for and contribute to audits conducted by Customer or an external
auditor selected by Customer in accordance with Section 3 of the Data Security Addendum.
At Customer’s expense and to the extent a more extensive audit is granted by Thomson
Reuters, then the parties agree to negotiate, in good faith, a statement of work that outlines
the scope and time frames of the audit.
4. DATA TRANSFERS.
4.1. General. Customer (or its agents) or Thomson Reuters will only Transfer (including any
onward Transfers) Customer Personal Data as permitted by Applicable Data Protection
Law.
4.2. Transfers of European Personal Data. To the extent Customer and/or Thomson Reuters
participate in a Data Privacy Framework (DPF) and such party’s participation governs the
relevant Transfers of Personal Data pursuant to the Agreement, then the parties shall comply
with each of their respective requirements of the Data Privacy Framework, including the
DPF Principles. If, under Applicable Data Protection Laws in the relevant jurisdiction, the
Data Privacy Framework does not cover the relevant Transfers and/or the relevant
DPF is invalidated, the parties agree that the terms of the EU Standard Contractual
Clauses, the UK Addendum, or UK International Data Transfer Agreement shall
apply to any Transfers of Personal Data governed by GDPR (or by the Applicable Laws
of a jurisdiction other than the EU/EEA where such laws expressly recognize the
GDPR Standard Contractual Clauses as a mechanism to legitimize the Transfer of
Personal Data) and/or the UK GDPR, respectively, to a country that has not received an
adequacy decision, provided that Customer shall first perform a transfer impact
assessment and implement any required additional safeguards prior to transferring the
Personal Data.
4.3. Other Data Transfers. If Applicable Data Protection Law requires the participation of
Thomson Reuters to legitimize the Transfer, such as the execution of Standard Contractual
Clauses, then Customer shall notify Thomson Reuters and the parties will cooperate in good
faith to implement the required transfer mechanism.
5. GENERAL. All other terms and conditions of the Agreement remain in full force and effect. In
the event of any inconsistencies between this DPA and the Agreement, this DPA shall prevail as
it relates to the Processing of Customer Personal Data only. In the event of any inconsistencies
between this DPA and Applicable Data Protection Law, the relevant Applicable Data Protection
Law shall prevail but only to the extent that it governs the Processing of Customer Personal Data.
Version History
Prior Version Effective Date
www.tr.com/trdpa-jan-3-2023 January 3, 2023
www.tr.com/trdpa-june-7-2021 June 7, 2021