Legal
These are the terms on which we process personal data on behalf of our clients. They are published in full so that your legal review can begin immediately, rather than waiting on a document request.
Drafted against Article 28(3) of the UK and EU GDPR, section 21 of POPIA, and — for financial sector clients — Article 30 of the Digital Operational Resilience Act. Clause numbering is stable so that it can be cited in correspondence.
Document control
Version 2.0 · Effective 22 September 2026These are the data processing terms on which ZeroRisk Labs ("we", "us", the Processor) processes personal data on behalf of a client ("you", the Controller) when delivering an engagement. They are published so that your legal and procurement teams can complete their review before commercial discussions conclude, rather than discovering the terms at signature.
These terms form part of the engagement agreement between us and take effect on the date that agreement takes effect. Where an engagement agreement and these terms conflict on a data protection matter, these terms prevail unless the engagement agreement expressly states otherwise and the result is more protective of data subjects.
We will execute a countersigned copy of this agreement, including the transfer mechanism appropriate to your jurisdiction, on request and before processing begins. We will also complete your own template where your procurement process requires it.
This document is drafted to satisfy Article 28(3) of the UK GDPR and the EU GDPR and section 21 of the Protection of Personal Information Act 4 of 2013. It is published as a statement of the terms we will accept, and it does not replace the advice of your own legal advisers on your own obligations.
You are the Controller of Engagement Data. You determine the purposes and means of its processing, you are responsible for the lawfulness of the instructions you give us, and you warrant that you have a lawful basis for the processing you instruct.
We are the Processor of Engagement Data and act only on your documented instructions. Where the CCPA applies we are your service provider, and clause 17 sets out the additional commitments that status carries. We do not determine the purposes of processing Engagement Data, and we do not use it for our own purposes.
We are an independent Controller for the limited personal data we process for our own purposes — your contacts' business contact details, our records of the commercial relationship, and the records we must keep by law. That processing is governed by our Privacy Notice rather than by this agreement.
If we ever act outside your instructions in a way that determines the purpose and means of processing, we accept that we become a Controller for that processing and assume Controller liability for it.
Article 28(3) requires the subject matter, duration, nature, and purpose of the processing, the type of personal data, and the categories of data subjects to be set out. The engagement-specific detail is recorded in Annex 1 below and is completed for your engagement in the engagement agreement.
We process Engagement Data only on your documented instructions, including in relation to any international transfer, unless we are required to process it by a law to which we are subject that respects the essence of fundamental rights and freedoms and is proportionate to a legitimate aim. Where we are compelled by law, clause 15 governs how we respond, and we do not treat legal compulsion as a general licence to depart from your instructions.
Your instructions are the engagement agreement, the agreed scope and rules of engagement, and any subsequent written instruction. Instructions given by email are documented instructions for this purpose.
If we are required by law to process Engagement Data otherwise than on your instructions, we will inform you of that legal requirement before processing, unless the law prohibits us from doing so.
We will inform you without undue delay if, in our opinion, an instruction infringes Applicable Data Protection Law. We will say so in writing and pause the affected work rather than proceeding under protest.
We ensure that every person we permit to process Engagement Data is subject to a binding duty of confidentiality, whether by contract of employment, contractor agreement, or statutory duty, and that the duty survives the end of their engagement with us.
Access to Engagement Data is limited to those personnel who require it to deliver the services, and is withdrawn when it is no longer required.
We do not disclose your identity, the existence of an engagement, or any finding arising from it to any third party without your prior written authorisation, except where disclosure is required by a binding legal obligation.
We implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK and EU GDPR and section 19 of POPIA. Those measures are described by category in Annex 2.
We take account of the state of the art, the cost of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects, when assessing what is appropriate.
We do not publish control parameters, configuration values, or architectural detail, because that information would materially assist an attacker while adding nothing to your assessment. Full detail is provided under a non-disclosure agreement as part of due diligence, and we will complete your security questionnaire.
You give general written authorisation for us to engage the Sub-processors listed in our published register. That register is maintained as a living document and forms Annex 3 to this agreement.
We assist you in fulfilling your obligations to respond to data subject requests, taking into account the nature of the processing and the information available to us.
Taking into account the nature of the processing and the information available to us, we assist you in meeting the obligations set out below. This clause gives effect to Article 28(3)(f).
This assistance is provided at no additional charge where it relates to our own processing or to an incident affecting it. Where you request extensive assistance that goes beyond our processing, we will agree the basis for it in advance and in writing rather than invoicing you unexpectedly.
We notify you of a Personal Data Breach affecting Engagement Data without undue delay and in any event within 24 hours of becoming aware of it. This deadline is deliberately shorter than the 72 hours you have under Article 33, so that the majority of your own notification window remains available to you. Where POPIA applies, section 21(2) requires us to notify you *immediately*, and clause 16 governs — the 24-hour figure is an outer limit, not a permission to wait.
We do not delay an initial notification in order to complete our investigation. We notify on the facts available, clearly marked as preliminary, and supply further detail in phases as it is established.
We cooperate fully with your investigation, preserve evidence relevant to it, and do not make any public statement about a breach affecting your Engagement Data without your prior written agreement, unless we are legally required to.
On termination or expiry of the engagement, and at your choice, we delete or return all Engagement Data. We then delete existing copies unless we are required by law to retain them, in which case we tell you what we are retaining and on what legal basis.
Where your engagement agreement provides for the deliverable set to be retained for a defined period — commonly the term plus 24 months, to support retesting, audit evidence, or the defence of legal claims — that agreed period is your documented instruction to retain under clause 5, and it operates as an exception to the paragraph above. We retain only the material covered by that instruction, only for the period stated, and we delete it at the end of that period without needing a further instruction. Absent such a provision, the default is deletion or return on termination. We never retain Engagement Data on our own initiative.
Working material generated during delivery — testing artefacts, captured credentials, forensic working copies, and interim analysis — is the highest-risk category of data we hold. We delete it within 30 days of your acceptance of the final deliverable unless you instruct us in writing to retain it for longer. This applies regardless of any longer retention period agreed for the deliverable set.
Deletion is performed securely. Where data in backup media cannot be deleted immediately, it is placed beyond use and destroyed on the next scheduled destruction cycle. We confirm completion of deletion in writing on request.
We make available to you all information necessary to demonstrate compliance with this agreement and with Article 28, and we allow for and contribute to audits and inspections conducted by you or by an auditor you appoint.
We are established in India. Your instruction to process Engagement Data therefore involves a transfer out of the United Kingdom, the European Economic Area, or South Africa as applicable. India is not the subject of a UK or EU adequacy decision, and we do not suggest otherwise.
We enter into the transfer mechanism appropriate to your jurisdiction before processing begins:
MechanismStandard Contractual Clauses, Module Two (controller to processor)
We enter into the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021. India is not the subject of an adequacy decision under Article 45 of the EU GDPR, so transfers rely on Article 46 safeguards supported by a transfer impact assessment and, where that assessment requires them, supplementary technical and organisational measures.
MechanismInternational Data Transfer Agreement, or the EU SCCs with the UK International Data Transfer Addendum
The EU Standard Contractual Clauses are not a valid transfer mechanism on their own under the UK GDPR. We therefore enter into either the ICO's International Data Transfer Agreement or the EU SCCs together with the ICO's International Data Transfer Addendum, at the controller's election, supported by a transfer risk assessment.
MechanismContractual protection — no statutory transfer mechanism is imposed by US law
Neither federal law nor the state privacy statutes impose a GDPR-style restriction on transferring personal information outside the United States, so there is no equivalent of the Standard Contractual Clauses to execute. We do not treat that as a reason to offer less protection. Our service provider commitments under the CCPA Regulations apply in full wherever the processing occurs, and we extend the same technical and organisational measures, breach notification timescales, sub-processor controls, and government access commitments to US client data as we do to data originating in the United Kingdom or the European Economic Area. Where an engagement involves protected health information, a Business Associate Agreement is executed before processing begins.
MechanismOperator agreement satisfying section 72 of POPIA
Transfers are made under a written agreement that subjects the personal information to a level of protection substantially similar to the conditions for lawful processing under POPIA, including the further-processing and security-safeguard provisions, as contemplated by section 72(1)(a).
Where the Standard Contractual Clauses are incorporated, the annexes to those Clauses are populated from Annex 1, Annex 2, and Annex 3 of this agreement, and Clause 17 governing law and Clause 18 forum are completed in the engagement agreement. We supply our transfer impact assessment or transfer risk assessment for the relevant corridor on request.
We are established in India, outside the United Kingdom, the European Economic Area, and the Republic of South Africa. A controller's transfer impact assessment therefore has to consider whether a public authority in our jurisdiction could compel access to your Engagement Data. We address that question directly rather than leaving you to assume the worst.
The commitments below mirror Clauses 14 and 15 of the EU Standard Contractual Clauses and apply whether or not those Clauses have been signed:
The first of these is a statement of fact as at the effective date of this agreement, and we will correct it here if it ceases to be true. We recognise that a controller may suspend transfers and terminate under the Standard Contractual Clauses if we become unable to honour these commitments, and we do not contest that right.
Where you are a responsible party subject to POPIA, the following apply in addition to the clauses above, giving effect to sections 19, 20, 21, and 72 of that Act.
Where you are a business subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act, we act as your service provider and not as a third party. The following give effect to the contract requirements in section 7051 of the CCPA Regulations, which are mandatory and which a GDPR-style processor clause does not satisfy on its own.
The specific business purposes for which we process personal information are those set out in the engagement agreement and Annex 1. They are stated specifically rather than by generic reference to the contract as a whole, as section 7051(a)(2) requires.
One permitted use is worth stating plainly because it is the substance of our work: section 7050(a)(4) of the Regulations allows a service provider to use personal information to prevent, detect, or investigate data security incidents and to protect against malicious, deceptive, fraudulent, or illegal activity, even where that purpose is not separately specified. Our engagements fall squarely within it. We rely on that provision only for the security purposes you have engaged us for, and never as a route to a purpose of our own.
Generic processor terms do not adequately address what actually happens during offensive security testing or a forensic investigation. The following provisions are specific to the services we deliver and form part of our instructions from you.
Where you are a financial entity within the scope of Regulation (EU) 2022/2554 (the Digital Operational Resilience Act), we will enter into a contractual annex addressing the elements required by Article 30(2), including a complete description of the services and any subcontracting, the locations in which services are provided and data is processed together with advance notice of any change, provisions on availability, authenticity, integrity and confidentiality of data, provisions on access, recovery, and return of data, service level descriptions, assistance in the event of an ICT incident, cooperation with your competent and resolution authorities, termination rights and notice periods, and participation in your security awareness and digital operational resilience training.
Where the services support a critical or important function, we will additionally address the requirements of Article 30(3), including quantitative and qualitative performance targets, unrestricted rights of access, inspection, and audit, participation in threat-led penetration testing, and an exit strategy with a defined transition period.
Where you are an essential or important entity under Directive (EU) 2022/2555 (NIS2), we will provide the supplier assurance information you require to discharge your supply chain security obligations under Article 21(2)(d), and to account for our specific practices as required by Article 21(3).
Where an engagement involves protected health information and you are a covered entity or business associate under HIPAA, we execute a Business Associate Agreement before processing begins, apply the Security Rule administrative, physical, and technical safeguards to that information, and observe the minimum necessary standard. The Breach Notification Rule allows a business associate up to 60 days to report; our commitment in clause 11 is 24 hours and we do not rely on the longer statutory period.
Where you are a financial institution subject to the GLBA Safeguards Rule (16 C.F.R. Part 314), we provide the service provider oversight evidence you need to satisfy § 314.4(f), including our security measures documentation and the right of periodic assessment under clause 13.
Where you are a covered entity under 23 NYCRR Part 500, we support your third party service provider security policy obligations under § 500.11, including representations on access controls, encryption, notification, and your right to audit.
Where you are an SEC registrant, we recognise that Item 1.05 of Form 8-K requires disclosure within four business days of your determining that a cybersecurity incident is material. During an incident we prioritise giving you the factual findings you need to make and document that determination inside that window, and we will say clearly what is established fact and what remains under investigation.
We will not claim that a generic agreement satisfies a sector-specific regulatory requirement. Where an annex is needed, we produce one.
Each party is liable for its own compliance with Applicable Data Protection Law. Nothing in this agreement relieves either party of its own statutory obligations.
Where the Standard Contractual Clauses or the International Data Transfer Agreement are incorporated, and any provision of this agreement conflicts with them, those instruments prevail to the extent of the conflict.
Limitations of liability agreed in the engagement agreement apply to claims under this agreement, save that no limitation applies to the extent it would be unenforceable under Applicable Data Protection Law, and no limitation restricts a data subject's rights against either party.
This annex satisfies the descriptive requirements of Article 28(3) and populates Annex I of the Standard Contractual Clauses. Engagement-specific values are completed in the engagement agreement.
Described by category, in line with clause 7. Implementation detail, configuration values, and control parameters are supplied under a non-disclosure agreement, because publishing them would assist an attacker without improving your assessment.
The Sub-processors you authorise under clause 8 are those published in our Sub-processor Register, which forms this annex and is maintained as a living document so that it cannot fall out of date relative to this agreement.
Our own operations are conducted from India. Our sub-processors are global providers that may process data in more than one jurisdiction in the course of delivering platform-level functions such as content delivery and mail routing. The specific processing regions applicable to an engagement are recorded in the engagement agreement and are available to clients on request.
To receive a countersigned Data Processing Agreement incorporating the transfer mechanism for your jurisdiction, or to have us complete your own template, contact us with the subject line below. We aim to return a countersigned agreement within 5 business days.
A note on citation, to avoid ambiguity in correspondence: a lower-case "clause" refers to a clause of this agreement, and a capitalised "Clause" refers to a clause of the EU Standard Contractual Clauses or the International Data Transfer Agreement. Numbering overlaps between the two, so the distinction is deliberate.
ZeroRisk Labs
Ambari, Guwahati, Assam 781001, India
Please use the subject line Data Processing Agreement so your message is routed correctly on arrival.
Please tell us your jurisdiction so that we send the correct transfer mechanism with the agreement.