(Last updated April 2025)
This Personal Data Processing Agreement with its Schedules (“DPA”) forms part of the agreement between Sage and the Customer for the provision of Sage’s software products or cloud-based software application services to the Customer (“Services”) (the “Agreement”).
Where there is any conflict between the terms of this DPA and any other part of the Agreement, the following order of precedence shall apply: (1) any Transfer Mechanism applicable to the Agreement; (2) this DPA; and (3) any other part of the Agreement.
-
DEFINITIONS
Capitalised terms used in this DPA that are not defined herein shall have the meaning given to them under the relevant Data Protection Laws, and a list of equivalent terms in the Data Protection Laws can be found in Schedule 3. Other capitalised terms in this DPA shall have the meaning given to them below.
“Adequacy Decision”: a finding by the European Commission, or a government or body authorised to make a finding, in accordance with Data Protection Laws, that a recipient country ensures an adequate level of protection of Personal Data, so that further steps/mechanisms are not required to be implemented under Data Protection Laws in relation to a Transfer to a Non-Adequate Country.
“Affiliate”: an entity that directly or indirectly controls, or is controlled by, or under common control with, the subject entity. “Control” for purposes of this definition means the ownership or control (whether directly or indirectly) of at least 50% of the voting rights in the entity, or otherwise the power to direct the management and policies of the entity.
“Customer”: the Customer entity that has entered into the Agreement and where applicable, any Customer Affiliate.
“Data Protection Laws”: any applicable local, national, or international laws, rules and regulations related to privacy, security, data protection, and/or the Processing of Personal Data, as amended, replaced, or superseded from time to time. Depending on where the Customer is based, this may include but is not limited to: (a) the General Data Protection Regulation (EU) 2016/679 (“GDPR”); European Union (“EU”) member state data protection laws; and the Privacy and Electronic Communications Directive 2002/58/EC on Privacy and Electronic Communications ; (b) the UK Data Protection Act 2018 (and regulations made thereunder) and UK GDPR; and the Privacy and Electronic Communications (EC Directive) Regulations 2003; (c) the California Consumer Privacy Act of 2018 (“CCPA”); the California Privacy Rights Act of 2020 (“CPRA”); (d) the Canada Personal Information Protection and Electronic Documents Act (PIPEDA); (e) the Swiss Federal Act on Data Protection; (f) the South Africa Protection of Personal Information Act (POPIA); and (g) the Australian Privacy Act 1988.
“Data Subject”: an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Deidentified Information”: information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular Data Subject.
“Non-Adequate Country”: a country that is not covered by an Adequacy Decision.
“Parties”: the parties to this DPA, specifically (i) Sage and (ii) the Customer each a “Party”.
“Personal Data”: information relating to a natural person that is included in the data provided, inputted, or submitted by the Customer, or one of the Customer’s Affiliates, Users, or others on the Customer’s behalf, into the Services provided under the Agreement, or shared with Sage by any means in connection with the Services and the Agreement.
“Transfer to a Non-Adequate Country”: a transfer of Personal Data to a Non-Adequate Country.
“Transfer Mechanism”: the relevant module of the standard contractual clauses for a Transfer to a Non-Adequate Country pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, implemented through Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“SCCs”), as adapted for any jurisdiction to the extent permitted by Data Protection Laws, or similar mechanism in respect of any other jurisdiction, such as the UK Addendum template or UK International Data Transfer Agreement template as issued by the ICO in accordance with s.119A of the Data Protection Act 2018.
“Sage”: the Sage entity which has entered into the Agreement.
“Sensitive Personal Data”: any Personal Data that is given a higher level of protection under Data Protection Laws.
“Sub-Processor”: another party engaged by a Processor to assist with the Processing of Personal Data on behalf of a Controller.
“User”: an individual who is authorised to use the Services (for instance, individuals who have been supplied with a user identification and password by the Customer, or by Sage at the Customer’s request). Users may include Customer’s employees, consultants, contractors, agents or other third parties.
- PROCESSING ROLES
- Except as set out in Schedule 1 (Purpose(s) of the Processing, part (b)), the Parties agree that where Data Protection Laws apply to the Processing of Personal Data, the Customer is the Controller, and Sage is the Processor in relation to the Processing (which is more fully described in Schedule 1) and Sage will act in accordance with the Customer’s documented instructions and in accordance with the Data Protection Laws in carrying out that Processing.
- Where the Customer itself is acting as a Processor under Data Protection Laws in Processing Personal Data described in Schedule 1 on behalf of its own customers or other parties, Sage will be the Customer’s Sub-Processor, and the obligations in this DPA will apply to Sage as a Sub-Processor.
- CUSTOMER’S OBLIGATIONS
- The Customer shall comply with, and procure the compliance of Customer Affiliates, Users, other contacts of the Customer, or third parties who may use the Services, the Data Protection Laws in Processing Personal Data ahead of sharing it in connection with Sage’s provision of the Services to Customer.
- The Customer warrants on an ongoing basis that:
- it has an appropriate lawful basis under Data Protection Laws to share Personal Data with Sage in connection with the provision of the Services; and
- where it is acting as a Processor under Data Protection Laws, the relevant Controller has authorised: (i) the Customer’s Personal Data Processing instructions to Sage (as set out in this DPA); (ii) the Customer’s appointment of Sage as a Sub-Processor; and (iii) Sage’s use of further Sub-Processors as described in clause 4.9 (Use of Sub-Processors).
- The Customer further agrees that it shall:
- where necessary, and as required by the Data Protection Laws, provide sufficient information to Data Subjects regarding the Processing of their Personal Data, or procure the same, for: (i) the Customer to share the Personal Data with Sage for the provision of the Services; and (ii) Sage to Process the Personal Data for the purposes set out in the Agreement and in accordance with Data Protection Laws;
- not do or cause Sage to do anything which would put Sage in breach of Data Protection Laws or violate the rights of any Data Subject; and
- provide reasonable assistance to Sage in complying with Sage’s obligations under Data Protection Laws, including by entering into any amendments or additions to this DPA which may be necessary to reflect any changes in the Customer’s, or Sage’s, Personal Data Processing activities, or otherwise as required by Data Protection Laws.
-
SAGE’S OBLIGATIONS
INSTRUCTIONS
- By entering into the Agreement, where Sage is operating as a Processor or Sub-Processor, Customer is instructing Sage to Process Personal Data to provide the Services and any related support to the Customer. Sage’s Personal Data Processing activities for these purposes are more fully described in Schedule 1. The Customer further instructs Sage to comply with Sage’s Personal Data Processing obligations as a Processor or Sub-Processor as set out in the rest of this DPA.
- Sage shall notify the Customer of any legal requirement which may prevent Sage from complying with Customer’s instructions as set out in this DPA, unless the legal requirement prohibits this.
- Sage shall inform the Customer without delay if, in Sage’s opinion, instructions given by the Customer infringe Data Protection Laws.
- Sage shall promptly notify the Customer if it determines that it can no longer meet its obligations under Data Protection Laws or this DPA.
- Sage shall comply with the Data Protection Laws whilst such Personal Data is in its control.
- Where the CCPA (as amended by the CPRA) applies:
- If Sage receives Deidentified Information from Customer, Sage shall (a) take reasonable measures to ensure that Deidentified Information cannot be associated with a Data Subject or household, (b) publicly commit to maintain and use the Deidentified Information in deidentified form, and (c) not attempt to reidentify the Deidentified Information except for the sole purpose of determining whether our deidentification processes satisfy the requirements of applicable Data Protection Laws.
- Where Sage is acting as a Service Provider, Sage shall not combine Personal Data with Personal Data we receive from or on behalf of another person or entity or collect from our own interactions with a Data Subject, except to perform a business purpose as defined in applicable Data Protection Laws.
- Sage shall not share, sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, Personal Data to another person or entity for: (i) monetary or other valuable consideration; or (ii) cross-context behavioural advertising for the benefit of a business in which no money is exchanged.
- Customer shall have the right, upon notice, to stop and remediate any unauthorised Processing of Personal Data.
SECURITY
- Sage shall have in place at all times appropriate technical and organisational measures to prevent any unauthorised or unlawful Processing, or accidental loss or destruction, of Personal Data, taking into account the state of the art, the costs of implementation, the nature of the relevant Personal Data Processing, and the risk to the rights and freedoms of the relevant Data Subjects. Such security measures may include:
- the pseudonymisation or encryption of Personal Data;
- the ability to timely restore the availability and access to Personal Data in the event of an incident;
- the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems; and
- a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures. More details can be found here: https://www.sage.com/en-gb/trust-security/security/
- Sage shall:
- take reasonable steps to ensure the reliability of any personnel who may have access to the Personal Data;
- ensure that access, if any, to the Personal Data is strictly limited to those individuals who need to know and/or access the Personal Data for the purposes set out in the Agreement; and
- ensure that personnel authorised to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
USE OF SUB-PROCESSORS
- The Customer hereby generally authorises Sage’s use of Sub-Processors and Sage’s list of criteria used to select and appoint a Sub-Processor, which is as follows:
- Sage will conduct reasonable due diligence on the data privacy and security measures of proposed Sub-Processors before providing them with access to Personal Data;
- Sage will carry out data protection impact assessments ahead of appointing a Sub-Processor where any Processing of Personal Data by a Sub-Processor is likely to result in a high risk to the rights and freedoms of Data Subjects;
- as required under Data Protection Laws, Sage will ensure that it puts in place a contract with any appointed Sub-Processor which imposes on the Sub-Processor, in substance, the same data protection obligations as imposed on Sage in this DPA; and
- Sage shall keep its relationships with Sub-Processors under review and take any further steps as may be required under Data Protection Laws or in relation to any changes to Customer’s or Sage’s Personal Data Processing activities.
- Sage shall remain fully responsible to the Customer for the performance of the Sub-Processor’s obligations under the Sub-Processor’s contract with Sage.
- A list of Sage’s Sub-Processors is here. Given Sage's international organisation, Sage's Affiliates may be involved in the Processing of Personal Data, in particular for support purposes. When this occurs, Sage Affiliates act as Sub-Processors and intra-group data processing agreements govern the Processing of Personal Data. Please contact Sage should you require information on Sub-Processors for a Service that is not included on the list from the link above.
- If Sage wishes to make any changes to Sub-Processors, Sage shall update the list and inform the Customer where we consider this to have a material effect on the Services provided to the Customer as required by the applicable Data Protection Laws and as described in the region-specific terms, and the Customer may reasonably object within thirty (30) days to such changes.
INTERNATIONAL TRANSFERS
- The Customer acknowledges and accepts that the provision of the Services may involve the Processing of Personal Data by Sage or its Sub-Processors in countries outside of the country in which the Customer, Customer’s Affiliates or Users are based, subject to the terms of this DPA.
- Sage shall comply with Data Protection Laws in carrying out any international transfers of Personal Data. Depending on the transfer and the region in which the Customer, Customer’s Affiliates or Users are located, specific international transfer provisions will apply which may include, where applicable, Sage’s intra-group data processing agreements , or any other Transfer Mechanism. For the purposes of compliance with this clause 4.14, the EU SCCs set out in Schedule 2 are incorporated into this Agreement to be relied on to the extent necessary to cover such transfers.
- The Customer agrees that Sage may transfer Personal Data between Sage Affiliates on the terms of its intra-group data processing agreements, which incorporate appropriate data transfer mechanisms.
- In the event that a Transfer to a Non-Adequate Country is necessary between the Customer and a Sage Affiliate as no other valid transfer mechanism applies to such transfer, the transfer shall not be made until the Customer and relevant Sage Affiliate have entered into a contractual agreement incorporating the EU SCCs (controller-controller module, controller-processor module, and/or processor-processor module accordingly) will apply depending upon the respective roles of each party as controller or processor, details of which are set out in Schedule 2.
PERSONAL DATA BREACH
- In the case of a Personal Data Breach, Sage shall notify the Customer without undue delay, and take actions that Sage reasonably considers necessary and possible to contain and mitigate the effects of such Personal Data Breach (subject to any instructions regarding the same from the Customer).
- The notification referred to in clause 4.17 above shall at least:
- describe the nature of the Personal Data Breach including where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
- communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
- describe the likely consequences of the Personal Data Breach; and
- describe the measures taken or proposed to be taken by the controller to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as it is not possible to provide the information at the same time, the information may be provided in phases without further undue delay.
AUDIT
- Subject to any audit provisions in the Agreement, Sage shall provide the Customer with information reasonably necessary to demonstrate Sage’s compliance with this DPA or allow the Customer to conduct an audit of Sage’s Processing of the relevant Personal Data, at Customer’s sole cost and expense.
- The frequency of inspections set out in clause 4.19 above shall be no more than once a year and the scope of the audit shall be agreed to at least 30 days prior to the date of the audit. This is without prejudice to the right of the Customer to carry out further inspections on an ad hoc basis in the event of violations of data protection obligations by Sage or Sage’s Sub-Processors.
OTHER
- Sage shall, without undue delay, notify the Customer in relation to any communication from a Data Subject, Supervisory Authority or other body in relation to Personal Data.
- Taking into account the nature of the Processing, Sage shall:
- assist the Customer by appropriate technical and organisational measures, insofar as this is possible, for any obligations the Customer has under Data Protection Laws to respond to requests from individuals for exercising their rights; and
- provide the Customer with reasonable assistance to comply with any obligations it has under Data Protection Laws relating to: (i) ensuring the security of the Personal Data; (ii) notifications of Personal Data Breaches to Supervisory Authorities; (iii) prior consultations with Supervisory Authorities; (iv) communication of any of Personal Data Breaches to Data Subjects; and (v) data protection impact assessments.
- Where Sage is acting as a Processor or Sub-Processor on behalf of the Customer, at the end of Sage’s provision of the Services, Sage shall, at the choice of the Customer, delete or return to the Customer all Personal Data Processed by Sage on the Customer’s behalf and delete existing copies unless Data Protection Laws requires storage of the Personal Data.
Schedule 1 – Description of Personal Data Processing
Categories of Data Subjects whose Personal Data is Processed
Depending on what Personal Data the Customer, a Customer Affiliate or a User submits to the Services, or otherwise share(s) with Sage, in connection with the Services provided under the Agreement, Sage may Process Personal Data relating to the following individuals:
- Customer’s employees, contractors, workers, applicants or other personnel;
- Customer’s suppliers, customers, business partners, or prospects (where such parties are individuals);
- Users to the extent not covered above; and
- Other contacts the Customer may have (where they are individuals and not covered above).
Categories of Personal Data processed
Personal Data the Customer submits to the Services provided under the Agreement, or otherwise share with Sage or a Sage Affiliate, in order for Sage to provide such Services, is determined by the Customer at the Customer's discretion. As many of our Services are customisable, the Personal Data submitted/shared will often depend on the options and the commercialisation method chosen by the Customer.
A breakdown of Personal Data Processed by Sage to provide our key Services is below (provided that this data relates to an individual).
- Business profile information: name and contact details, registration details, business type, where registered, payment details, transaction information and history, tax records, relationship information and correspondence with business.
- Invoice information: name and contact details, account information, registration details, tax number, payment amount, payment terms, and details of Services covered by invoice.
- Payroll information (only for payroll products/payroll add-ons): name and contact details, registration/reference numbers, basic pay amount, tax types and amounts, deduction types and amounts, payment amounts and frequency, bank account details, tax code, social security number, pay period, gross and net earnings, hours totals, sick and holiday pay amounts.
- HR information (only for HR products/HR add-ons): name, role, level in organisation, address and other contact details, payroll information (see above), date of birth, appraisal records, absence records, sickness records, holiday information (holiday dates, duration, reason, frequency), disciplinary and grievance records, job and salary history, next of kin, dependencies, emergency contact information.
- Planning and forecasting information (only for reporting/forecasting products or add-ons): information in the categories above (as applicable), inventory records, order and warehousing records.
- Client management information (only for client management products/add-ons): name, address, and other contact information and other personal information on engagement letters and proposals, anti-money laundering (AML) information, and know-your-client (KYC) information.
- Information captured through any specific additional functionality required (depending on type of functionality): information in the categories above (as applicable), bank information, reporting information (such as transactions matched to emission factors creating initial carbon footprint estimate), forecasting and prediction information (predicted costs, sales, expenses, cash, profit, tax liability, overdue invoices/bills, budgets and comparisons).
Sensitive Personal Data (including “Special Category” data under the GDPR, i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation) may at times be captured and transferred in connection with the Services, if shared by a Data Subject described above.
Sage ensures that it applies additional restrictions or safeguards with regard to Processing Sensitive Personal Data, including by: (i) ensuring that the Processing of Sensitive Personal Data is avoided wherever possible; (ii) accountability processes (for instance carrying out data protection impact assessments) are followed in relation to Processing Sensitive Personal Data; (iii) staff are provided with appropriate training on handling Sensitive Personal Data; (iv) additional contractual and due diligence measures are applied where possible; and (v) anonymisation, pseudonymisation and password-protection are applied to Sensitive Personal Data where possible.
Frequency of the Processing
Continuous basis based on the Customer or a Customer Affiliate’s use of the Services.
Nature of the Processing
Sage may Process Personal Data described above in the following ways in order to provide the Services to the Customer: collection, recording, organisation, structuring, storage, copying, displaying, reformatting, adaptation or alteration, anonymisation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, synchronisation with cloud services.
Purpose(s) of the Processing
- Personal Data is Processed by Sage as a Processor (or Sub-Processor, where the Customer is a Processor) to provide, protect, support, enable, improve and maintain the Services in connection with the Agreement. If the Customer opts to subscribe to, or interact with, any particular additional Services (as described in the Agreement), Sage may upload, copy and/or transfer Customer’s Personal Data to facilitate these options. Where applicable, this may include synchronising Customer Personal Data with certain Sage cloud-based Services. If the Customer chooses to connect the Services to third-party products or services, Sage will use the Customer’s Personal Data to make that connection. Where Sage receives Personal Data because of that connection, Sage will use that Personal Data in line with the Agreement.
- If the Customer directs Sage to Process Personal Data as part of a Service that utilises artificial intelligence, this may be undertaken by Sage as a Controller. Sage also Processes Personal Data as a Controller for the purposes set out in the Sage Privacy Notice. In all such cases, Sage will comply with all relevant provisions in this DPA and requirements under Data Protection Laws.
- Notwithstanding anything to the contrary in the previous section, where the CCPA (as amended by the CPRA) applies, if the Customer opts-in or otherwise directs Sage to Process Personal Data as part of a Service that utilises artificial intelligence, Sage will Process Personal Data as a Service Provider for solely internal uses, where permitted under applicable Data Protection Laws. Where Data Protection Laws prohibit Sage from Processing Personal Data for solely internal uses, Sage will comply with the following:
- Sage will Process Personal Data only for the limited and specified purpose of providing the Service that utilises artificial intelligence.
- Sage will comply with applicable Data Protection Laws, including providing the same level of protection for the Personal Data as required by Data Protection Laws.
- Customer may take reasonable and appropriate steps to ensure that Sage use the Personal Data in a manner consistent with the obligations imposed by the applicable Data Protection Laws, and Customer may, upon notice, take reasonable and appropriate steps to remediate unauthorised use of Personal Data.
- Sage will promptly notify Customer if Sage determines that it can no longer meet its obligations under applicable Data Protection Laws or this DPA.
Schedule 2 – Transfer Mechanism
OPTIONS AND ANNEXES I, II AND III TO EU SCCS
1.1 OPTIONS:
Module used |
- SCC Module 1 shall be used where the Customer and Sage each acts as a Controller of the Personal Data.
- SCC Module 2 shall be used where the Customer acts as a Controller and Sage acts as a Processor of the Personal Data.
- SCC Module 3 shall be used where the Customer acts as a Processor and Sage acts as a Sub-Processor of the Personal Data.
|
Clause 7 (Docking Clause) |
The optional docking clause shall be included |
Clause 9 (a) (Use of sub-processors) |
For Modules 2 and 3, Option 2 shall apply, and the specified time period shall be a reasonable time period |
Clause 11 (Redress) |
The optional language shall not be included |
Clause 13 (Supervision) |
Clause 13 (Supervision) The competent supervisory authority shall be the supervisory authority of: (a) the EU member state in which the data exporter is established; (b) if the data exporter does not have an EU establishment, the EU member state in which the data exporter’s representative is established; or (c) if the data exporter does not have an EU establishment and is not required to appoint a representative, one of the member states in which the relevant individuals are located |
Clause 17 (Governing Law) |
For Module 1, Option 1 shall apply and the specified law shall be the governing law of the Agreement or the governing law of the country in which the data exporter is based, and for Modules 2 and 3, Option 2 shall apply and the specified law shall be the governing law of the Agreement, or if not in the EEA/UK, the governing law of the country in which the data exporter is based, (in each case solely for the EU SCCs) |
Clause 18 (Choice of Forum and Jurisdiction) |
As per the jurisdiction provisions of the Agreement, or if not in the EEA/UK, the governing law of the country in which the data exporter is based (solely for the EU SCCs). |
The additional sections for the Processor to Processor module in clauses 14, 15 and 16 shall be included where the Processor to Processor module applies to transfer.
ANNEX I A: LIST OF PARTIES:
Data exporter(s): Customer
Name and Address: as provided to Sage
Contact person’s name, position and contact details: as provided to Sage
Activities relevant to the data transferred under these Clauses: to obtain the Services under the Agreement.
Signature and date: as Agreement confirmed or executed by Customer
Role (controller/processor): Controller (Module 1) or Processor (Module 2 and 3)
Data importer(s): (depending on Service): Brightpearl, Inc., Intacct Software Private Ltd, Ocrex Australia Pty Ltd, Ocrex, Inc. (US), Sage Budgeta, Inc., Sage Business Solutions Pty Limited, Sage Business Technology (India) Private Limited (Formerly known as Ocrex Enterprises Private Limited), Sage Global Services Limited, Sage Intacct, Inc., Sage Software Holdings, Inc., Sage Software, Inc., Sage Software North America, Sage South Africa Proprietary Limited, and possibly other importers in the Sage group from time to time (see signature pages).
Activities relevant to the data transferred under these Clauses: to provide the Services under the Agreement.
Role (controller/processor): Processor
ANNEX I B: DESCRIPTION OF TRANSFER:
See Schedule 1.
Additionally:
(a) The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): the Personal Data may be transferred on a continuous basis for the duration of the Services.
(b) The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period: the Personal Data described in Schedule 1 shall be retained for as long as is necessary in order to provide the Services, and in order for the data importer to fulfil any applicable legal requirements or obligations.
(c) For transfers to (Sub-)Processors, also specify subject matter, nature and duration of the Processing: the subject matter, nature and duration of sub-processing is as described in Schedule 1 and above.
ANNEX I C: COMPETENT SUPERVISORY AUTHORITY
As per Clause 13 (Supervision) in Options
ANNEX II: TECHNICAL AND ORGANISATIONAL MEASURES
Available at https://www.sage.com/en-gb/trust-security/ or upon request
ANNEX III: LIST OF SUB-PROCESSORS
See here
1.2 PARTS 1 AND 2 OF UK ADDENDUM (defined terms used in this section shall have the meaning given to them in UK Addendum. If not defined in UK Addendum, they shall have the meaning given to them in the DPA).
Part 1: Tables
Table 1: Parties
Start date |
Start date of agreement |
The Parties |
Exporter (who sends the Transfer to a Non-Adequate Country) |
Importer (who receives the Transfer to a Non-Adequate Country) |
Parties' details |
Customer |
As stated in section 1.1 of this Schedule 2. |
Key contact |
As provided to Sage |
As stated in section 1.1 of this Schedule 2. |
Table 2: Selected EU SCCs, Modules and Selected Clauses
Addendum EU SCCs |
The version of the Approved EU SCCs which this Addendum is appended to. |
Module |
Module in operation |
Clause 7 (Docking Clause) |
Clause 11 (Option) |
Clause 9a (Prior Authorisation or General Authorisation) |
Clause 9a (Time period) |
1 |
Module 1 |
Yes |
No |
N/A |
N/A |
2 |
Module 2 |
Yes |
No |
General Authorisation |
Reasonable time period |
3 |
Module 3 |
Yes |
No |
General Authorisation |
Reasonable time period |
Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in section 1.1 of this Schedule 2.
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Addendum when the
Approved Addendum changes
|
Which Parties may end this Addendum as set out in Section 19:
- Importer
- Exporter
neither party
|
Part 2: Mandatory Clauses
Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, are hereby incorporated.
1.3 PARTS 1 – 4 OF UK IDTA
Part 1: Tables
Table 1: Parties and signatures
See section 1.1 of this Schedule 2.
Table 2: Transfer Details
UK country’s law that governs the IDTA: |
England and Wales |
Primary place for legal claims to be made by the Parties |
England and Wales |
The status of the Exporter |
See section 1.1 of this Schedule 2 |
The status of the Importer |
See section 1.1 of this Schedule 2 |
Linked Agreements |
(a) If the importer is a Controller – the Agreement (including the DPA)
(b) If the Importer is the Exporter’s Processor or Sub-Processor – the Agreement (including the DPA)
(c) If the Exporter is a Processor or Sub-Processor – the agreement(s) between the Exporter and the Party(s) which sets out the Exporter’s instructions for Processing the Transferred Data
|
Term |
The Importer may Process the Transferred Data for the following time period:
The period for which Linked Agreement (a) is in force
|
Ending the IDTA before the end of the Term |
The Parties can end the IDTA before the end of the Term by serving six months’ written notice, as set out in Section 29 (How to end this IDTA without there being a breach). |
Ending the IDTA when the Approved IDTA changes |
Which Parties may end the IDTA as set out in Section 29.2: Importer or Exporter |
Can the Importer make further transfers of the Transferred Data? |
The Importer may transfer on the Transferred Data to another organisation or person (who is a different legal entity) in accordance with Section 16.1 (Transferring on the Transferred Data). |
Specific restrictions when the Importer may transfer on the Transferred Data |
There are no specific restrictions. |
Review Dates |
The Parties must review the Security Requirements each time there is a change to the Transferred Data, Purposes, Importer Information, TRA or risk assessment. |
Table 3: Transferred Data
Transferred Data |
See Schedule 1 of the DPA |
Special Categories of Personal Data and criminal convictions and offences |
See Schedule 1 of the DPA |
Relevant Data Subjects |
See Schedule 1 of the DPA |
Purpose |
See Schedule 1 of the DPA |
Table 4: Security Requirements
See Annex II of Schedule 2
Mandatory Clauses
The following are hereby incorporated: Part 4: Mandatory Clauses of the Approved IDTA, being the template IDTA A.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 5.4 of those Mandatory Clauses.
1.4 SIGNATURES OF SAGE AFFILIATES (to the extent that they act as data importers): see pages here.
Schedule 3 - Equivalent terms
Term in DPA |
Equivalent terms in other Data Protection Laws |
Personal Data |
Personal Information, Personally Identifiable Information |
Controller |
Responsible Party, Business |
Personal Data Breach |
Security Compromise, POPIA Data Breach |
Processor |
Operator, Service Provider, Contractor |
Data Subject |
Consumer |
Download a PDF version