FIXTURE DOCUMENT — authored by the oneproof project as pipeline test data.
This is not a real agreement and describes no real party.

DATA PROCESSING ADDENDUM (SAMPLE)

3. Sub-processors

The processor may engage sub-processors. The processor must notify the
controller of any intended change to its sub-processors at least thirty (30)
days before the change takes effect. The controller may object to the change
within that period.

7. Security incidents

The processor must notify the controller of a personal data breach without
undue delay. Notification must be made within seventy-two (72) hours of the
processor becoming aware of the breach. A notification made after that period
must state the reasons for the delay.

9. Return and deletion

On termination the processor must return or delete all personal data. Deletion
must be completed within sixty (60) days of the termination date unless
retention is required by law. Where retention is required the processor must
state the legal basis in writing.
