{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Processor agreement (GDPR art. 28) - Belgium","description":"The contract between a controller and a processor required by art. 28 (3) of Regulation (EU) 2016/679: subject-matter and duration, nature and purpose, type of personal data and categories of data subjects, the controller's obligations and rights, and the processor's obligations a) to h). The governing law and the competent courts are fields.","type":"object","required":["agreement","controller","processor","subject_matter","duration","nature","purpose","data_types","data_subject_categories","controller_obligations_and_rights","sub_processing","end_of_services","governing_law","courts"],"additionalProperties":false,"properties":{"agreement":{"type":"object","required":["date"],"additionalProperties":false,"properties":{"reference":{"type":"string"},"date":{"type":"string","format":"date","description":"Date of the agreement."},"place":{"type":"string","description":"Place of signature."}}},"controller":{"$ref":"#/$defs/party"},"processor":{"$ref":"#/$defs/party"},"main_agreement_reference":{"type":"string","description":"The services agreement this processor agreement belongs to, where there is one."},"subject_matter":{"type":"string","minLength":1,"description":"The subject-matter of the processing."},"duration":{"type":"string","minLength":1,"description":"The duration of the processing."},"nature":{"type":"string","minLength":1,"description":"The nature of the processing (the operations carried out)."},"purpose":{"type":"string","minLength":1,"description":"The purpose of the processing."},"data_types":{"type":"array","minItems":1,"items":{"type":"string"},"description":"The type of personal data."},"data_subject_categories":{"type":"array","minItems":1,"items":{"type":"string"}},"special_categories":{"type":"array","items":{"type":"string"},"description":"Special categories of data (art. 9) or data relating to criminal convictions (art. 10), where processed. An empty list states that there is none."},"controller_obligations_and_rights":{"type":"string","minLength":1,"description":"The obligations and rights of the controller, as agreed by the parties."},"sub_processing":{"type":"object","required":["authorisation"],"additionalProperties":false,"properties":{"authorisation":{"type":"string","enum":["not_authorised","specific","general"],"description":"not_authorised: the processor engages no other processor. specific: only the processors listed. general: a general written authorisation, with information on any intended change and the controller's opportunity to object."},"authorised_processors":{"type":"array","items":{"type":"object","required":["name","service"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"service":{"type":"string","minLength":1},"location":{"type":"string"}}}},"change_notice_days":{"type":"integer","minimum":0,"description":"General authorisation: number of days of advance information on an intended change, as agreed."}},"allOf":[{"if":{"properties":{"authorisation":{"const":"specific"}},"required":["authorisation"]},"then":{"required":["authorised_processors"]}}]},"security_measures":{"type":"array","items":{"type":"string"},"description":"The technical and organisational measures agreed under art. 32."},"transfers":{"type":"array","description":"Transfers to a third country or an international organisation the controller instructs. An empty list states that there is none.","items":{"type":"object","required":["destination"],"additionalProperties":false,"properties":{"destination":{"type":"string","minLength":1},"safeguard":{"type":"string"}}}},"breach_notice_hours":{"type":"integer","minimum":0,"description":"Maximum number of hours, as agreed, within which the processor notifies the controller of a personal data breach after becoming aware of it."},"end_of_services":{"type":"string","enum":["delete","return","choice_at_end"],"description":"At the end of the services: delete all personal data, return them, or as the controller chooses at that time."},"audit_terms":{"type":"string","description":"The agreed terms of audits and inspections (notice, frequency, costs)."},"governing_law":{"type":"string","minLength":1,"description":"The law that governs the agreement, as agreed."},"courts":{"type":"string","minLength":1,"description":"The competent courts, as agreed."}},"$defs":{"party":{"type":"object","required":["name","address","contact"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"enterprise_number":{"type":"string","pattern":"^[01][0-9]{3}\\.[0-9]{3}\\.[0-9]{3}$"},"address":{"type":"string"},"contact":{"type":"string"},"signatory_name":{"type":"string"},"signatory_title":{"type":"string"}}}}}