Snapshot 5876
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Cardinal Health Data Processing Agreement
This Data Processing Agreement (“DPA”) is supplemental to and forms an integral part of the
Service agreement(s) between the parties (the “Service Agreement”) between Cardinal Health
(“Cardinal Health” or “Entity”) and the party providing Services under the applicable Service
Agreement (“Vendor”) (each a “Party”; collectively, the “Parties”). This DPA reflects the
agreement of the Parties with respect to personal information processing, including collection, use,
transfer, and storage. The processing details, including the subject matter, nature, purpose(s),
frequency, and duration, are provided, to the extent applicable, in the Appendix (Annex I.B) of
Schedule D of this DPA. Schedules A, B, C, and D along with any Annexes form an integral part
of this DPA.
Vendor agrees that, by executing this DPA, Cardinal Health enters into this DPA on behalf of itself
and in the name and on behalf of its Authorized Affiliates, thereby establishing a separate DPA
between Vendor and each such Authorized Affiliate. For clarity, an Authorized Affiliate is not and
does not become a party to the Service Agreement and is only a party to this DPA.
The Parties agree that this DPA replaces any existing data processing agreement or similar
document that the Parties may have previously entered into with regard to the services
contemplated in the Service Agreement.
If there is a conflict or inconsistency between any terms in this DPA, including the Schedules
attached hereto, and the Service Agreement, the following is the order of precedence for these
documents and related Schedules: (1) the Standard Contractual Clauses (Schedule D); (2) any
additional jurisdiction-specific terms (Schedule A); (3) this DPA; and (4) the Service Agreement.
1. Definitions
1.1. “Applicable Data Protection Laws” means collectively all applicable laws and
regulations, as revised from time to time, related to data protection, privacy, and
security that apply to the Parties with regard to the processing of Personal
Information under this DPA, including, to the extent applicable, the California
Consumer Privacy Act, Canada’s Personal Information Protection and Electronic
Documents Act, the European Union’s General Data Protection Regulation
(“GDPR”), the General Data Protection Regulation as it forms part of the law of
the United Kingdom (“UK GDPR”) (as defined in the UK Data Protection Act 2018
(as amended by the Data Protection, Privacy and Electronic Communications
(Amendments etc.) (EU Exit) Regulations 2018 (SI 2019/419)) along with the
United Kingdom’s Data Protection Act 2018 (“UK DPA”), and the Data (Use and
Access) Act 2025, and any other supranational, national, state, or local privacy and
data protection laws, rules, and regulations in effect on or after the effective date of
this DPA.
1.2. “Authorized Affiliate” means any Cardinal Health affiliate that is subject to
Applicable Data Protection Laws and permitted to benefit from the services
contemplated in the Service Agreement.
1.3. “Cardinal Health Data” means all information, Personal Information as defined
below, data, and materials processed, collected, maintained, transmitted, or hosted
by or through systems or services provided by or on behalf of Vendor or accessible
to Vendor during performance of the Service Agreement.
1.4. “Entity” means the business, data controller, organization, or other natural or legal
person that, alone or jointly with others, determines the purposes and means of data
processing. For the purposes of this DPA, Cardinal Health is the Entity.
1.5. “Individual” means an identified or identifiable data subject, consumer, or other
natural person to whom the Personal Information relates.
1.6. “Personal Information” means any information relating to an identified or
identifiable Individual, including as such information may be defined in any
Applicable Data Protection Laws, that Vendor processes on behalf of Cardinal
Health, including any Personal Information collected, maintained, transmitted, or
hosted by or through systems or services provided by or on behalf of Vendor or
accessible to Vendor during the course of performance of the Service Agreement.
“Personal Information” also includes information relating to a legal person to the
extent such information is protected under Applicable Data Protection Laws.
1.7. “Processing” (and the related terms “process,” “processes,” and “processed”)
means any operation or set of operations performed upon Personal Information,
including access, alteration, collection, combination, destruction, disclosure,
dissemination, erasure, organization, retrieval, storage, structuring, transfer, and
use.
1.8. “Restricted Transfer” means any transfer of Personal Information that would be
prohibited under Applicable Data Protection Laws in the absence of relevant
safeguards, such as Standard Contractual Clauses.
1.9. “Sub-processor” means any service provider engaged by Vendor to assist with
fulfilling obligations with respect to providing the services requested by Entity.
1.10. “Vendor” means the service provider, data processor, or other natural or legal
person engaged to process Personal Information on behalf of Entity.
1.11. All other defined terms from Applicable Data Protection Laws that appear in this
DPA, such as “business purpose,” “commercial purpose,” “collect,” “sell,” and
“share,” will each have the meaning ascribed to them in the relevant Applicable
Data Protection Laws.
2. Roles of the Parties and Their Processing Obligations
2.1. Vendor will process Personal Information only in accordance with Entity’s
documented instructions and only for the purposes of providing the Services.
Vendor will not sell Personal Information for monetary or other valuable
consideration or use Personal Information for targeted or cross-context behavioral
Page 2 of 13
advertising, except as explicitly instructed in writing by Cardinal Health. If Vendor
reasonably believes that any Entity processing instruction violates Applicable Data
Protection Laws, Vendor will immediately notify Entity.
2.2. Both Parties represent and warrant that they have complied with, and will continue
to comply with, all Applicable Data Protection Laws. If Vendor becomes aware or
reasonably believes that it can no longer comply with this DPA or Applicable Data
Protection Laws, Vendor will immediately notify Entity and suspend the processing
of Personal Information. Vendor may resume processing Personal Information only
upon receipt of revised Entity instructions. If Vendor cannot resume processing,
Entity may terminate the Service Agreement without penalty.
2.3. To the extent Vendor’s processing of Entity Personal Information is subject to
Applicable Data Protection Laws in a jurisdiction listed in Schedule A, Vendor will
comply with the jurisdiction specific requirement identified therein.
3. Confidentiality and Vendor Personnel
3.1. Vendor will treat all Personal Information as Confidential Information, as defined
in the Service Agreement, and Vendor will not disclose Personal Information
without Entity’s prior written consent.
3.2. If Vendor receives deidentified Personal Information from Cardinal Health or if
Vendor is permitted by Cardinal Health to deidentify Personal Information, Vendor
will not reidentify, attempt to reidentify, or permit or direct any other person to
reidentify any deidentified Personal Information. Vendor will take reasonable
measures to ensure that the information cannot be reidentified and contractually
obligate any third parties receiving such data to enter into the same commitments.
3.3. Prior to disclosing Personal Information in response to any public authority request,
including requests from regulatory authorities, law enforcement, and courts,
Vendor will assess and document the legality of the request, provide advance notice
to Entity, and cooperate with Entity in any response. In response to any public
authority request for disclosure, Vendor will only disclose the minimum amount of
Personal Information necessary to comply with the valid legal obligation.
3.4. Vendor will strictly limit access to Personal Information to those Vendor personnel
performing services in accordance with the Service Agreement.
3.5. Vendor will ensure that all Vendor personnel with access to Personal Information
are (1) informed of the confidential nature of the Personal Information; (2) aware
of relevant obligations under this DPA; (3) regularly, and in any event no less than
annually, provided relevant training on privacy and data protection; and (4) subject
to appropriate confidentiality obligations with respect to Personal Information.
Page 3 of 13
4. Security
4.1. Taking into account the state of the art, implementation costs, the nature of Personal
Information, and processing risks, Vendor has implemented and will maintain
appropriate technical and organizational measures designed to protect Personal
Information from unlawful processing and to preserve the security, integrity,
availability, confidentiality, and resilience of Personal Information and Vendor’s
processing systems and services. At a minimum, Vendor will maintain the technical
and organizational measures described in the applicable security controls under the
Service Agreement (the “Security Policy Exhibit”), and to the extent cross-border
transfers are applicable, Appendix (Annex II) of Schedule D to this DPA, including
any specific measures to protect sensitive Personal Information and processes for
regularly testing, assessing, evaluating, and improving the effectiveness of
Vendor’s security measures.
4.2. Vendor will document its security measures and evaluations of such security
measures in written form and make those documents available to Entity for review
upon Entity’s request, subject to confidentiality controls.
4.3. Vendor will ensure that there is no material decrease in the level of security afforded
to Personal Information while this DPA is in effect. Any material decrease in the
security safeguards shall be reported to Entity without delay.
5. Privacy Incident Management
5.1. Vendor will at all times have written procedures in place to enable Vendor to
respond quickly to any unauthorized access to, misappropriation of, loss of, damage
to, or other compromise of the security, integrity, availability, or confidentiality of
Cardinal Health Data (each a “Privacy Incident”).
5.2. Vendor will notify Entity within 72 hours of when Vendor becomes aware of any
Privacy Incident and take immediate steps to address the Privacy Incident and
mitigate potential harm that may result from the Privacy Incident.
5.3. Vendor will provide detailed, timely information to Entity about the Privacy
Incident as such information becomes known, including (a) a description of what
happened in the Privacy Incident; (b) the date and time when the Privacy Incident
took place and was discovered by Vendor; (c) the number of people and records
affected by the Privacy Incident; (d) the categories of Personal Information
involved; (e) the security measures in place at the time of the Privacy Incident;
(f) any measures taken or planned to address the Privacy Incident, including
measures to mitigate the possible adverse effects of the Privacy Incident and
prevent recurrence. Vendor will designate a point of contact who can respond to
Entity questions and provide Entity with additional information about the Privacy
Incident.
Page 4 of 13
5.4. Except as required by law, Vendor will not communicate with any third party
regarding any Privacy Incident, unless and until expressly instructed to do so by
Entity.
5.5. With regard to any Privacy Incident, Vendor will at all times fully and promptly
cooperate with Entity and follow Entity’s instructions in regard to the processing
of Cardinal Health Data. As requested by Entity, Vendor will at Vendor’s own cost
reasonably assist Entity with performing a thorough investigation, assessing the
potential risk to Individuals, and providing any necessary notifications (and
associated credit or identity monitoring) to regulatory authorities and Individuals.
6. Vendor Assistance to Entity
6.1. General Assistance. Vendor will reasonably assist Entity to fulfill Entity’s
obligations under Applicable Data Protection Laws.
6.2. Compliance with this DPA. At Entity’s request, Vendor will provide Entity with
information and evidence to demonstrate compliance with this DPA and Applicable
Data Protection Laws. Vendor will designate personnel to support Entity in
monitoring Vendor’s compliance with this DPA and to facilitate the provision of
information and evidence related to Vendor’s compliance to Entity.
6.3. Audit Rights. Vendor will allow for and cooperate with Entity’s auditing of its
compliance with this DPA and Applicable Data Protection Laws (a) annually,
(b) upon indication of Vendor’s non-compliance with this DPA or Applicable Data
Protection Laws, or (c) following a Privacy Incident. Entity will take reasonable
measures to limit unnecessary impact on Vendor as a result of any audit,
assessment, or other compliance checks.
6.3.1. Upon Entity’s request, Vendor will provide Entity with the final reports or
findings from Vendor’s most recent third-party audit, including whether
that audit revealed any material vulnerability in Processor’s Systems,
facilities, policies, controls, or practices, and evidence that such
vulnerabilities have been remediated.
6.3.2. Any audits of Vendor or Vendor’s processing activities will include, at the
request of Entity, verification as to whether any Personal Information has
been disclosed to public authorities and, if so, the conditions under which
such disclosure was made.
6.3.3. Entity may also require Vendor to complete a compliance assessment or
questionnaire, to confirm that Vendor and/or its Sub-processors are
complying with their obligations with respect to the Personal Information
under this DPA and any Applicable Data Protection Laws. Such
assessments or questionnaires will be completed promptly, and in any event
within five (5) business days, by Vendor.
Page 5 of 13
6.3.4. If during any audit or other compliance checks, any material security
vulnerability or other material compliance failure is discovered, Vendor
shall promptly remediate such deficiencies and provide evidence of the
remediation to Entity upon completion. Entity may choose to prepare a
corrective action plan for Vendor, which may include remediation timelines
and due dates. Vendor’s failure to correct material deficiencies or
implement the action plan by reasonable due dates specified in the action
plan will constitute a material breach of the Services Agreement and this
DPA.
6.4. Processing Risk Assessment. Vendor will provide Entity with requested
information to allow Entity to carry out a data protection impact assessment,
privacy impact assessment, other processing risk assessment, or prior consultation
with a regulator related to Vendor’s processing of Personal Information.
6.5. Individual Rights Requests. Vendor shall, within three (3) business days, provide
Entity with a copy of any request received related to exercising an Individual’s
rights under Applicable Data Protection Laws in relation to Personal Information,
including requests to access, correct, delete, or restrict the processing of Personal
Information.
6.5.1. Vendor will respond to Individuals’ requests by directing Individuals to
Entity, unless Entity provides written instructions otherwise. If Vendor is
legally obligated to reply to an Individual’s request, Vendor will promptly
notify Entity and provide a copy of the response, unless legally prohibited.
6.5.2. If Entity requests information from Vendor to fulfill its obligation to
respond to an Individual’s rights request, Vendor shall provide the
requested information in the requested format within three (3) business days
of receiving Entity’s request for assistance. Vendor shall immediately notify
Entity if Vendor is unable to comply with the request for assistance or
requires additional time to fulfill the request for information. Such
notification shall provide an explanation as to why Vendor considers
compliance with the request for assistance to be impracticable or requires
more time, including how much additional time is required.
6.5.3. Vendor will assist Entity as necessary to fulfill an Individual’s valid request,
including by correcting, deleting, or restricting the processing of Personal
Information processed by Vendor and similarly instructing its Sub-
processors.
6.6. Other Questions and Complaints. Vendor will directly respond to any questions
or complaints it receives, including those from Individuals and regulatory
authorities, concerning Vendor’s compliance with this DPA. Vendor will provide
Entity with a copy of such questions or complaints and Vendor’s response within
five (5) business days.
Page 6 of 13
7. International Data Transfers
7.1. Except as provided in Schedule B to this DPA or in documented instructions from
Entity, any Restricted Transfer of Personal Information by Vendor is prohibited. In
the event of a Restricted Transfer of Personal Information from the European
Economic Area, United Kingdom or Switzerland by Entity to Vendor not provided
for in Schedule B sub-sections 1 to 4, the Parties agree to the Standard Contractual
Clauses included in Schedule D, which are deemed signed and incorporated herein.
7.2. For a Restricted Transfer of Personal Information by Vendor, based on documented
instructions from Entity, Vendor must complete and provide Entity with a copy of
a data transfer impact assessment that conforms with Applicable Data Protection
Laws.
8. Subcontracting
8.1. Vendor may engage any Sub-processor identified in Schedule C, as updated from
time to time, to process Personal Information in connection with the provision of
services contemplated in the Service Agreement.
8.2. If Vendor wishes to revise the list of approved Sub-processors that may process
Personal Information, Vendor will provide written notice to Entity at least thirty
(30) days in advance of the anticipated date that the new Sub-processor will begin
processing Personal Information. Entity may object to the new Sub-processor in
writing within thirty (30) days of receiving Vendor’s notice. If Entity objects to the
new Sub-processor, Entity may then terminate the relevant processing activity
without penalty if no acceptable substitute can be identified.
8.2.1. Vendor will provide its written notice identifying the new Sub-processor
and providing relevant information from Vendor’s assessment of the Sub-
processor along with the privacy and data protection provisions of the
agreement with the Sub-processor by email to
thirdparty@cardinalhealth.com.
8.2.2. No new Sub-processor may process Personal Information until the Entity
has either (a) accepted the new Sub-processor, or (b) the time to object has
elapsed.
8.3. All Sub-processors processing Personal Information must be subject to a written
agreement imposing substantially the same, and in any case no less onerous,
obligations on each Sub-processor as the obligations imposed on Vendor under this
DPA. At Entity’s request, and subject to confidentiality controls, Vendor will
promptly send to Entity a copy of the privacy and data protection provisions of the
agreement concluded with any Sub-processor that will process Personal
Information.
Page 7 of 13
8.4. Vendor remains fully responsible for and liable to Entity for each Sub-processor’s
processing of Personal Information. Vendor may not invoke the conduct of a Sub-
processor to avoid its own liability.
9. Use of Artificial Intelligence (AI)
a. “Artificial Intelligence” or “AI” means a machine-based system designed to
operate with varying levels of autonomy, that may exhibit adaptiveness after
deployment and that, for explicit or implicit objectives, infers, from the input it
receives, how to generate outputs such as predictions, content, recommendations,
or decisions that can influence physical or virtual environments.
b. Vendor will not include or use AI in the Services or include or use any Cardinal
Health Confidential Information, including Personal Information, in any AI
systems without receiving Cardinal Health’s explicit prior written approval. In
seeking such approval, Vendor will provide all information requested by Cardinal
Health to facilitate its assessment of any proposed Artificial Intelligence use,
including the terms, conditions, representations, warranties, and indemnities
governing or related to the use or ownership of the AI and AI outputs.
c. The Parties agree to negotiate additional protections and provisions for Cardinal
Health’s data prior to any additional use cases not originally contemplated under
the Services Agreement and this DPA.
10. Return or Deletion of Personal Information
10.1. Unless Vendor has a valid legal obligation to retain Personal Information or
Cardinal Health requests the return of Personal Information, Vendor will securely
destroy all Personal Information and destroy any existing copies within thirty (30)
calendar days following the completion of the services contemplated in the Service
Agreement or upon termination of this DPA.
10.1.1. Subject to the obligations set out in Clause 9.1.3 below, Vendor may retain
Personal Information as part of its regular backups in accordance with
Vendor’s standard deletion schedule for such backups.
10.1.2. Vendor must inform Entity, unless legally prohibited from doing so, of any
legal obligation to retain Personal Information beyond the duration of the
processing on Entity’s behalf.
10.1.3. Any Personal Information retained by Vendor must be securely maintained
and not further processed, except to the extent necessary to comply with
Vendor’s legal obligation(s). Vendor must continue to protect retained
Personal Information in compliance with this DPA and Applicable Data
Protection Laws.
Page 8 of 13
11. Liability and Indemnity
11.1. The Liability and Indemnity terms of the applicable Service Agreement shall apply.
11.2. Insurance. Vendor will obtain and maintain Cyber Liability / Technology Errors &
Omissions Liability insurance with a limit sufficient to cover the costs of potential
Privacy Incidents and subsequent related litigation or regulatory investigations. In
no way do these insurance requirements limit the liability assumed elsewhere in
this Addendum or the Services Agreement, including but not limited to Provider’s
defense and indemnity obligations.
12. Miscellaneous
12.1. Allocation of Costs. Unless otherwise stated, each Party will perform its
obligations under this DPA at its own costs.
12.2. Duration of the DPA. This DPA will remain in effect until all Personal
Information and copies of it are no longer in Vendor’s possession or accessible to
Vendor.
12.3. Governing Law. Except as otherwise required, this DPA shall be governed by the
law of the applicable Service Agreement.
12.4. Notice and Cure. If Vendor violates this DPA and fails to remedy the breach within
thirty (30) days, Entity is entitled to immediate suspension or termination of the
Service Agreement without penalty.
12.5. Severability. If any single provision of this DPA is determined to be invalid,
unlawful, or unenforceable by a competent court or regulator, the validity and
enforceability of the other provisions in this DPA will not be affected. The
provision determined to be invalid, unlawful, or unenforceable will continue to be
in force in those jurisdictions that do not recognize the competency of the court or
regulator making the decision.
Page 9 of 13
Schedule A
Jurisdiction-Specific Supplemental Requirements
1. Australia Requirements
Where Entity acts as a contracted service provider to an Australian government organization at
federal, state, or territory level, and to the extent Entity is bound to comply with additional data
protection obligations by virtue of an agreement with the relevant government organization, Entity
may impose equivalent obligations upon Vendor, as required by applicable Australian law. Entity
and Vendor agree to enter into additional agreements, if needed, to reflect those obligations.
2. China Requirements
Vendor will provide reasonable assistance to Entity in obtaining consent from Individuals located
in Mainland China under Applicable Data Protection Legislation. Vendor will not transfer any
Personal Information outside of Mainland China without Entity’s written authorization and will
reasonably cooperate with Entity in entering into any ancillary agreements reasonably requested
by Entity to facilitate such transfers under the law of Mainland China. When processing Personal
Information that includes the Personal Information of residents of Mainland China, Vendor agrees
to comply with Applicable Data Protection Laws in China, as amended and updated from time to
time, along with any implementing measures and regulations in relation to cybersecurity and data
protection to the extent inconsistent with the general obligations of this DPA, unless they present
an unforeseeable substantial obligation. In such instances, Vendor agrees to notify Entity and come
to an agreement regarding the corresponding obligations.
3. European Economic Area/United Kingdom/Switzerland Requirements
The Parties will reasonably cooperate in ensuring that they have entered into any ancillary
agreements required under Applicable Data Protection Laws in the European Economic Area,
United Kingdom and Switzerland, including the then current versions of applicable Standard
Contractual Clauses where required in accordance with Schedule B, and complete any relevant
appendices. Where requested by Entity, Vendor will ensure that any applicable Sub-processors,
provide necessary signatures to add another party via the Docking Clause provided in Clause 7 of
the European Union’s Standard Contractual Clauses for Personal Data Transfers to Third
Countries in Schedule D of this DPA, where applicable.
4. Japan Requirements
For clarity, as the terms “controller” and “processor” are not similarly defined under Japanese law,
the Entity is the business operator that handles Personal Information under the Japanese Act on
the Protection of Personal Information. The Vendor is entrusted with the handling of Personal
Information in order to achieve a purpose. Vendor will provide reasonable assistance to Entity in
obtaining consent from Individuals located in Japan as required for the transfer of Personal
Information under Applicable Data Protection Legislation, where approved in writing by Entity.
Page 10 of 13
5. Kingdom of Saudi Arabia (KSA)
Personal Information may only be transferred from KSA provided that Vendor has entered into
required safeguards such as Standard Contractual Clauses, and one of the following conditions
applies: Vendor is fulfilling contractual obligations to which the KSA or the Individual is a party,
Vendor is serving the interests of the KSA, providing services or benefits to the Individual,
conducting scientific research and studies, or performing necessary operations for central
processing to enable Entity to carry out its activities.
6. Republic of Korea Requirements
For clarity, Vendor is deemed the “person entrusted” under the law of the Republic of Korea.
Vendor will provide reasonable assistance to Entity in obtaining consent from Individuals located
in the Republic of Korea under Applicable Data Protection Legislation. Personal Information
containing the Personal Information of Korean residents may only be processed by Vendor for
outsourced tasks at the request and direction of Entity. Such Personal Information also may not be
processed by Sub-processors without Entity’s written consent and subject to the same restrictions.
7. United States Requirements (California)
To comply with the California Consumer Privacy Act, as amended and including any regulations,
(collectively, the “CCPA”) the following obligations additionally apply (a) solely to the
processing of Personal Information subject to the CCPA and (b) only when such Personal
Information is not considered protected health information subject to the obligations of the Health
Insurance Portability and Accountability Act of 1996 or the other laws specified in Section
1798.145(c) of the CCPA (“Entity California Personal Information”). Vendor shall be a service
provider to Entity for purposes of processing subject to the CCPA.
a. Vendor shall comply with the CCPA at all times when processing Entity California
Personal Information and grants to Entity the right to take reasonable and appropriate steps
to ensure Vendor is processing Entity California Personal Information in compliance with
this DPA and Vendor’s obligations under the CCPA.
b. Vendor shall not retain, use, disclose, or otherwise process Entity California Personal
Information outside of Vendor’s direct business relationship with Entity. Specifically,
within the context of this business relationship, Vendor shall process, including retain, use,
and disclose, Entity California Personal Information solely to perform the services
requested by Entity as specified in the Service Agreement and Annex I.A of Schedule D,
including for the following business purposes, as applicable in accordance with the terms
of the Agreement and any relevant SOW:
i. Performing services on behalf of Entity, such as:
a. supporting business operations;
b. maintaining and servicing accounts and providing support;
c. verifying customer information;
d. processing payments;
e. fulfilling orders or completing transactions with or on behalf of Entity;
f. providing analytic services; and
Page 11 of 13
g. providing storage.
ii. Providing advertising and marketing services, including auditing related to ad
impressions and short-term, transient uses, but excluding cross-context behavioral
advertising.
iii. Ensuring security and integrity, including:
a. identifying and repairing errors that impair intended functionality;
b. verifying, maintaining, upgrading, improving, or enhancing the quality or
safety of products, services, and devices owned or operated by the Entity.
iv. Undertaking Vendor’s own internal research for technological development.
c. Vendor shall not:
i. sell or share Entity California Personal Information or otherwise process such
Entity California Personal Information for commercial purposes; or
ii. combine Entity California Personal Information with Personal Information
received from or on behalf of any other person or collected from Vendor’s own
interaction with an Individual.
d. Vendor understands the restrictions set forth in this DPA and under the CCPA and agrees
to comply with them. Vendor shall notify Entity promptly if at any time Vendor reasonably
believes that it can no longer meet its obligations under this DPA or the CCPA. Entity may
then take reasonable and appropriate steps to halt and remediate any unauthorized
processing of Entity California Personal Information. If Vendor’s Personal Information
processing on behalf of Entity cannot be restored in a compliant manner, Entity may
terminate the Service Agreement without penalty.
Page 12 of 13
Schedule B
Allowable International Data Transfers
For the purposes of providing the services contemplated in the Service Agreement, Vendor may
transfer Personal Information as described below as long as the transfer mechanism remains valid
under Applicable Data Protection Laws.
For data transfers not explicitly permitted in this Schedule, Vendor may only transfer Personal
Information with written approval from Entity. Vendor will ensure that it enters into any required
safeguards, including applicable Standard Contractual Clauses approved by the European
Commission, as reasonably directed by Entity.
Vendor may transfer Personal Information as follows. If the Restricted Transfer by Entity
originates:
1. From the European Economic Area or Switzerland to Andorra, Argentina, Canada
(commercial organizations only), Faroe Islands, Guernsey, Israel, Isle of Man, Japan
(private sector organizations only), Jersey, New Zealand, South Korea, Switzerland,
United Kingdom, Uruguay, United States (solely to commercial organizations with a valid
certification under the EU-U.S. Data Privacy Framework), and any other jurisdiction the
European Commission may formally recognize as adequate pursuant to a valid adequacy
decision.
2. From the United Kingdom to Andorra, Argentina, Canada (commercial organizations
only), the European Economic Area, the Faroe Islands, Gibraltar, Guernsey, Isle of Man,
Israel, Japan (private sector organizations only), Jersey, New Zealand, Switzerland,
Uruguay, United States (solely to commercial organizations with a valid certification under
the Data Privacy Framework for receipt of UK Personal Information), and any other
jurisdiction the a UK Secretary of State may formally recognize as adequate pursuant to a
valid adequacy decision.
3. From the United Kingdom to personnel or systems owned and controlled by the Entity in
any third country.
4. From the European Economic Area, Switzerland, or the United Kingdom to any of Entity’s
Authorized Affiliates provided Entity has entered into the European Union’s Standard
Contractual Clauses for Personal Data Transfers to Third Countries with its Affiliate.
Page 13 of 13