Drata Inc. (“Drata”) and the undersigned customer (“Customer”) enter into this Data Processing Addendum (including the annexes attached hereto, this “DPA”) as of the date signed by both parties. By signing this DPA the parties agree that this DPA shall supplement and form part of the Terms of Service available at https://drata.com/terms (collectively, the “Agreement”) between the parties under which Drata will provide certain services (collectively, the “Services”) to Customer.
For purposes of this DPA, the terms below have the meanings set forth below. Capitalized terms that are used but not defined in this DPA have the meanings given in the Agreement.
- (a) Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where “control” refers to the power to direct or cause the direction of the subject entity, whether through ownership of voting securities, by contract or otherwise.
- (b) Applicable Data Protection Laws means the privacy, data protection and data security laws and regulations of any jurisdiction applicable to the Processing of Personal Data under the Agreement, including, without limitation, European Data Protection Laws and the CCPA.
- (c) CCPA means the California Consumer Privacy Act of 2018 and any regulations promulgated thereunder, in each case, as amended from time to time, including the California Privacy Rights Act of 2020, and any regulations promulgated thereunder.
- (d) EEA means the European Economic Area.
- (e) European Data Protection Laws means the GDPR and other data protection laws and regulations of the European Union, its Member States, Switzerland, Iceland, Liechtenstein, Norway and the United Kingdom, in each case, to the extent applicable to the Processing of Personal Data under the Agreement.
- (f) GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, as amended from time to time.
- (g) Information Security Incident means a breach of Drata’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Drata’s possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
- (h) Personal Data means Customer Content that constitutes “personal data,” “personal information,” or “personally identifiable information” defined in Applicable Data Protection Law, or information of a similar character regulated thereby, except that Personal Data does not include such information pertaining to Customer’s personnel or representatives who are business contacts of Drata, where Drata acts as a controller of such information.
- (i) Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- (j) Security Measures has the meaning given in Section 4(a) (Drata’s Security Measures).
- (k) Standard Contractual Clauses means the mandatory provisions of the standard contractual clauses for the transfer of personal data to processors established in third countries in the form set out by European Commission Decision 2010/87/EU.
- (l) Subprocessors means third parties that Drata engages to Process Personal Data in relation to the Services.
- (m) Third Party Subprocessors has the meaning given in Section 5 (Subprocessors) of Annex 1.
- (n) The terms controller, data subject, processor and supervisory authority as used in this DPA have the meanings given in the GDPR.
2. Duration and Scope
- (a) This DPA will remain in effect so long as Drata Processes Personal Data, notwithstanding the expiration or termination of the Agreement.
- (b) Annex 1 (EU Annex) to this DPA applies solely to Processing subject to European Data Protection Laws. Annex 2 (California Annex) to this DPA applies solely to Processing subject to the CCPA to the extent Customer is a “business” (as defined in CCPA) with respect to such Processing.
3. Customer Instructions
Drata will Process Personal Data only in accordance with Customer’s instructions to Drata. This DPA is a complete expression of such instructions, and Customer’s additional instructions will be binding on Drata only pursuant to an amendment to this DPA signed by both parties. Customer instructs Drata to Process Personal Data to provide the Services and as authorized by the Agreement.
- (a) Drata Security Measures. Drata will implement and maintain administrative, technical and physical safeguards designed to protect the security and integrity of Personal Data, prevent Information Security Incidents (the “Security Measures”). The Security Measures shall at a minimum include the measures described in Annex 3 and any other measures required by Applicable Data Protection Laws. Drata may update the Security Measures from time to time, so long as the updated measures do not decrease the overall protection of Personal Data.
- (b) Information Security Incidents. Drata will notify Customer without undue delay of any Information Security Incident of which Drata becomes aware. Such notifications will describe available details of the Information Security Incident, including steps taken to mitigate the potential risks and steps Drata recommends the Customer take to address the Information Security Incident. Drata’s notification of or response to an Information Security Incident will not be construed as Drata’s acknowledgement of any fault or liability with respect to the Information Security Incident.
- (c) Customer’s Responsibilities
- (i) Customer Obligations. Without limitation of Customer’s obligations under the Agreement, Customer (a) agrees that Customer is solely responsible for its use of the Services, including (1) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data, (2) securing the account authentication credentials, systems and devices Customer uses to access the Services, (3) securing Customer’s systems and devices that Drata uses to provide the Services, and (4) backing up Personal Data; (b) shall comply with its obligations under Applicable Data Protection Laws; and (c) shall ensure (and is solely responsible for ensuring) that its instructions in Section 3 comply with Applicable Data Protection Laws, and that Customer has given all notices to, and has obtained all such notices from, individuals to whom Personal Data pertains and all other parties as required by applicable laws or regulations for Drata to Process Personal Data as contemplated by the Agreement. (d) Customer shall comply with its obligations under Applicable Data Protection Laws.
- (ii) Prohibited Data. Customer represents and warrants to Drata that Customer Data does not and will not, without Drata’s prior written consent, contain any social security numbers or other government-issued identification numbers, protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords for online accounts; credentials to any financial accounts; tax return data; credit reports or consumer reports; any payment card information subject to the Payment Card Industry Data Security Standard; information subject to the Gramm-Leach-Bliley Act, Fair Credit Reporting Act or the regulations promulgated under either such law; information subject to restrictions under Applicable Data Protection Laws governing Personal Data of children, including, without limitation, all information about children under 16 years of age; or any information that falls within any special categories of data (as defined in GDPR).
5. Data Subject Rights
- (a) Data Subject Request Assistance. Drata will (taking into account the nature of the Processing of Personal Data) provide Customer with assistance reasonably necessary for Customer to perform its obligations under Applicable Data Protection Laws to fulfill requests by data subjects to exercise their rights under Applicable Data Protection Laws (“Data Subject Requests”) with respect to Personal Data in Drata’s possession or control. Customer shall compensate Drata for any such assistance at Drata’s then-current professional services rates, which shall be made available to Customer upon request.
- (b) Customer’s Responsibility for Requests. If Drata receives a Data Subject Request, Drata will advise the data subject to submit the request to Customer and Customer will be responsible for responding to the request.
Except as expressly modified by the DPA, the terms of the Agreement remain in full force and effect. In the event of any conflict or inconsistency between this DPA and the other terms of the Agreement, this DPA will govern. Notwithstanding anything in the Agreement or any order form entered in connection therewith to the contrary, the parties acknowledge and agree that Drata’s access to Personal Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement. Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by Drata to Customer under this DPA may be given (a) in accordance with any notice clause of the Agreement; (b) to Drata’s primary points of contact with Customer; or (c) to any email provided by Customer for the purpose of providing it with Services-related communications or alerts. Customer is solely responsible for ensuring that such email addresses are valid.
Annex 1 to DPA
1. Processing of Data
- (a) Subject Matter and Details of Processing. The parties acknowledge and agree that (i) the subject matter of the Processing under the Agreement is Drata’s provision of the Services; (ii) the duration of the Processing is from Drata’s receipt of Personal Data until deletion of all Personal Data by Drata in accordance with the Agreement; (iii) the nature and purpose of the Processing is to provide the Services; (iv) the data subjects to whom the Personal Data pertains are employees of Customer; and (v) the categories of personal data are identification and contact data (for example, name, address, title, contact details), employment details (for example, employer, job title, geographic location and area of responsibility), and IT information (for example, IP addresses, usage data, cookies data, device specific information, connection data and location data) of the data subjects.
- (b) Roles and Regulatory Compliance; Authorization. The parties acknowledge and agree that (i) Drata is a processor of that Personal Data under European Data Protection Laws; (ii) Customer is a controller of that Personal Data under European Data Protection Laws; and (iii) each party will comply with the obligations applicable to it in such role under the European Data Protection Laws with respect to the Processing of that Personal Data.
- (c) Drata’s Compliance with Instructions. Drata will Process Personal Data only in accordance with Customer’s instructions stated in this DPA unless applicable European Data Protection Laws require otherwise, in which case Drata will notify Customer (unless that law prohibits Drata from doing so on important grounds of public interest).
- (d) Data Deletion. Drata shall delete all the Personal Data on Drata’s systems on Customer’s request and after the end of the provision of Services, and shall delete existing copies unless continued storage of the Personal Data is required by (i) applicable laws of the European Union or its Member States, with respect to Personal Data subject to European Data Protection Laws or (ii) Applicable Data Protection Laws, with respect to all other Personal Data. Drata will comply with such instruction as soon as reasonably practicable and no later than 180 days after such expiration or termination, unless Applicable Data Protection Laws require storage. Customer may choose to request a copy of such Personal Data from Drata for an additional charge by requesting it in writing at least 30 days prior to expiration or termination of the Agreement. Upon the parties’ agreement to such charge pursuant to a work order or other amendment to the Agreement, Drata will provide such copy of such Personal Data before it is deleted in accordance with this clause.
2. Data Security
- (a) Drata Security Measures, Controls and Assistance.
- (i) Drata Security Assistance. Drata will (taking into account the nature of the Processing of Personal Data and the information available to Drata) provide Customer with reasonable assistance necessary for Customer to comply with its obligations in respect of Personal Data under European Data Protection Laws, including Articles 32 to 34 (inclusive) of the GDPR, by (a) implementing and maintaining the Security Measures; (b) complying with the terms of Section 4(b) (Information Security Incidents) of the DPA; and (c) complying with this Annex 1.
- (ii) Security Compliance by Drata Staff. Drata shall ensure that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.
- (b) Reviews and Audits of Compliance. Customer may audit Drata’s compliance with its obligations under this DPA up to once per year and on such other occasions as may be required by European Data Protection Laws, including where mandated by Customer’s supervisory authority. Drata will contribute to such audits by providing Customer or Customer’s supervisory authority with the information and assistance reasonably necessary to conduct the audit. If a third party is to conduct the audit, Drata may object to the auditor if the auditor is, in Drata’s reasonable opinion, not independent, a competitor of Drata, or otherwise manifestly unsuitable. Such objection by Drata will require the Customer to appoint another auditor or conduct the audit itself. To request an audit, Customer must submit a proposed audit plan to Drata at least two weeks in advance of the proposed audit date and any third party auditor must sign a customary non-disclosure agreement mutually acceptable to the parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Drata will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Drata security, privacy, employment or other relevant policies). Drata will work cooperatively with Customer to agree on a final audit plan. Nothing in this Section 2(b) shall require Drata to breach any duties of confidentiality. If the controls or measures to be assessed in the requested audit are addressed in an SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third party auditor within twelve (12) months of Customer’s audit request and Drata has confirmed there have been no known material changes in the controls audited since the date of such report, Customer agrees to accept such report in lieu of requesting an audit of such controls or measures. The audit must be conducted during regular business hours, subject to the agreed final audit plan and Drata’s safety, security or other relevant policies, and may not unreasonably interfere with Drata business activities. Customer will promptly notify Drata of any non-compliance discovered during the course of an audit and provide Drata any audit reports generated in connection with any audit under this Section 2(b), unless prohibited by European Data Protection Laws or otherwise instructed by a supervisory authority. Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this DPA. Any audits are at Customer’s sole expense. Customer shall reimburse Drata for any time expended by Drata and any third parties in connection with any audits or inspections under this Section 2(b) at Drata’s then-current professional services rates, which shall be made available to Customer upon request. Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.
3. Impact Assessments and Consultations
Drata will (taking into account the nature of the Processing and the information available to Drata) reasonably assist Customer in complying with its obligations under Articles 35 and 36 of the GDPR, by (a) making available documentation describing relevant aspects of Drata’s information security program and the security measures applied in connection therewith and (b) providing the other information contained in the Agreement, including this DPA.
4. Data Transfers
- (a) Data Processing Facilities. Drata may, subject to Section 4(b) (Transfers out of the EEA), store and Process Personal Data in the United States or anywhere Drata or its Subprocessors maintains facilities.
- (b) Transfers out of the EEA. If Customer transfers Personal Data out of the EEA to Drata in a country not deemed by the European Commission to have adequate data protection, such transfer will be governed by the Standard Contractual Clauses, the terms of which are hereby incorporated into this DPA. In furtherance of the foregoing, the parties agree that
- (i) Customer will act as the data exporter and Drata will act as the data importer under the Standard Contractual Clauses;
- (ii) for purposes of Appendix 1 to the Standard Contractual Clauses, the categories of data subjects, data, special categories of data (if appropriate), and the Processing operations shall be as set out in Section 1(a) to this Annex 1 (Subject Matter and Details of Processing);
- (iii) for purposes of Appendix 2 to the Standard Contractual Clauses, the technical and organizational measures shall be the Security Measures;
- (iv) data importer will provide the copies of the subprocessor agreements that must be sent by the data importer to the data exporter pursuant to Clause 5(j) of the Standard Contractual Clauses upon data exporter’s request, and that data importer may remove or redact all commercial information or clauses unrelated the Standard Contractual Clauses or their equivalent beforehand;
- (v) the audits described in Clause 5(f) and Clause 12(2) of the Standard Contractual Clauses shall be performed in accordance with Section 2(b) of this Annex 1 (Reviews and Audits of Compliance);
- (vi) Customer’s authorizations in Section 5 (Subprocessors) of this Annex 1 will constitute Customer’s prior written consent to the subcontracting by Drata of the Processing of Personal Data if such consent is required under Clause 5(h) of the Standard Contractual Clauses; and
- (vii) certification of deletion of Personal Data as described in Clause 12(1) of the Standard Contractual Clauses shall be provided upon data exporter’s request.Notwithstanding the foregoing, the Standard Contractual Clauses (or obligations the same as those under the Standard Contractual Clauses) will not apply to the extent an alternative recognized compliance standard for the transfer of Personal Data outside the EEA in accordance with European Data Protection Laws applies to the transfer. In the event of any conflict or inconsistency between (a) this Annex 1 and any other provision of this DPA, this Annex 1 will govern, or (b) the Standard Contractual Clauses and any other provision of this Agreement, the Standard Contractual Clauses will govern.
- (a) Consent to Subprocessor Engagement. Customer specifically authorizes the engagement of Drata’s Affiliates as Subprocessors and generally authorizes the engagement of other third parties as Subprocessors (“Third Party Subprocessors”).
- (b) Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available at: https://drata.com/sub-processors (as may be updated by Drata from time to time) or such other website address as Drata may provide to Customer from time to time (the “Subprocessor Site”).
- (c) Requirements for Subprocessor Engagement. When engaging any Subprocessor, Drata will enter into a written contract with such Subprocessor containing data protection obligations not less protective than those in this DPA with respect to Personal Data to the extent applicable to the nature of the services provided by such Subprocessor. Drata shall be liable for all obligations under the Agreement subcontracted to, the Subprocessor or its actions and omissions related thereto.
- (d) Opportunity to Object to Subprocessor Changes. When Drata engages any new Third Party Subprocessor after the effective date of the Agreement, Drata will notify Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating the Subprocessor Site or by other written means. If Customer objects to such engagement in a written notice to Drata within 15 days after being informed of the engagement on reasonable grounds relating to the protection of Personal Data, Customer and Drata will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Drata and pay Drata for all amounts due and owing under the Agreement as of the date of such termination.
Annex 2 to DPA
1. For purposes of this Annex 2, the terms “business,” “commercial purpose,” “sell” and “service provider” shall have the respective meanings given thereto in the CCPA, and “personal information” shall mean Personal Data that constitutes personal information, the Processing of which is governed by the CCPA.
2. It is the parties’ intent that with respect to any personal information, Drata is a service provider. Drata shall (i) not “sell” (as defined in the CCPA) personal information; and (ii) not retain, use or disclose any personal information for any purpose other than for the specific purpose of providing the Services, including retaining, using or disclosing personal information for a commercial purpose (as defined in the CCPA) other than providing the Services. For the avoidance of doubt, the foregoing prohibits Drata from retaining, using or disclosing personal information outside of the direct business relationship between Drata and Customer. Drata hereby certifies that it understands the obligations under this Section 2 and shall comply with them.
3. The parties acknowledge that Drata’s retention, use and disclosure of personal information authorized by Customer’s instructions documented in the DPA are integral to Drata’s provision of the Services and the business relationship between the parties.
1. Organizational management and dedicated staff responsible for the development, implementation and maintenance of the Drata’s information security program.
2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Drata’s organization, monitoring and maintaining compliance with the Drata’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management.
3. Data security controls which include, at a minimum, logical segregation of data, restricted (e.g. role-based) access and monitoring, and utilization of commercially available industry standard encryption technologies for Personal Data that is transmitted over public networks (i.e. the Internet) or when transmitted wirelessly or at rest or stored on portable or removable media (i.e. laptop computers, CD/DVD, USB drives, back-up tapes).
4. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, (e.g. granting access on a need-to-know and least privilege basis, use of unique IDs and passwords for all users, periodic review and revoking/changing access promptly when employment terminates or changes in job functions occur).
5. Password controls designed to manage and control password strength, expiration and usage including prohibiting users from sharing passwords and requiring that the Drata’s passwords that are assigned to its employees: (i) be at least eight (8) characters in length, (ii) not be stored in readable format on the Drata’s computer systems; (iii) must have defined complexity; (iv) must have a history threshold to prevent reuse of recent passwords; and (v) newly issued passwords must be changed after first use.
6. System audit or event logging and related monitoring procedures to proactively record user access and system activity.
7. Physical and environmental security of data centers, server room facilities and other areas containing Personal Data designed to: (i) protect information assets from unauthorized physical access, (ii) manage, monitor and log movement of persons into and out of the Drata’s facilities, and (iii) guard against environmental hazards such as heat, fire and water damage.
8. Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from the Drata’s possession.
9. Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to the Drata’s technology and information assets.
10. Incident management procedures design to allow Drata to investigate, respond to, mitigate and notify of events related to the Drata’s technology and information assets.
11. Network security controls that provide for the use of enterprise firewalls and layered DMZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
12. Vulnerability assessment, patch management and threat protection technologies, and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.
13. Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergencies or disasters.