Legal

Data Processing Addendum

How we process personal data on your behalf: the roles each party takes, our documented instructions, international transfers, and the subprocessor terms.

Incorporated by reference into the Master Subscription Agreement at MSA §6.5.

All legal documents

NECESSITYWORKS, INC. — DATA PROCESSING ADDENDUM

Version: 1.0 Published at: https://necessityworks.com/legal/dpa Applies to: NecessityWorks, Inc. (Delaware) Governing law: Delaware, except where the SCCs or UK IDTA require otherwise

How this DPA is accepted

This DPA is incorporated by reference into the NW Master Subscription Agreement (“Agreement”) under §6.5 and applies automatically whenever NW Processes Personal Data on behalf of any Customer. No separate signature is required: Customer is bound by this DPA by the same acceptance event that binds Customer to the Agreement (click-through, Order Form, or first use of the Platform).

The Schedules at the bottom describe the processing details, including Schedule 1 (Processing Details) and Schedule 2 (Subprocessors). NW maintains a current Subprocessor list at https://necessityworks.com/legal/subprocessors.

THE ADDENDUM

This Data Processing Addendum (“DPA”) supplements and forms part of the Master Subscription Agreement (the “Agreement”) between NecessityWorks, Inc. (“NW”) and the Customer that has accepted the Agreement as defined therein (“Customer”). In the event of a conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA controls.

1. Definitions

Capitalized terms used but not defined in this DPA have the meanings given in the Agreement. The following terms apply throughout:

1.1 “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act and its implementing regulations.

1.2 “Controller”, “Processor”, “Data Subject”, “Processing”, and “Supervisory Authority” have the meanings given in the GDPR. Where these terms differ under another Data Protection Law, the applicable law’s definitions apply for processing subject to that law.

1.3 “Customer Personal Data” means Personal Data contained in Customer Data that NW Processes on behalf of Customer in connection with the Services.

1.4 “Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Data under this DPA, including GDPR, UK GDPR, the Swiss Federal Act on Data Protection, CCPA, the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”), and successor and equivalent laws.

1.5 “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

1.6 “Personal Data” means any information relating to an identified or identifiable natural person, as further defined under the applicable Data Protection Law.

1.7 “Personal Data Breach” means a Security Incident (as defined in §1.7A) that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data — i.e., the subset of Security Incidents that triggers Data Protection Law breach-notification obligations.

1.7A “Security Incident” means any breach of security or other event that results in, or is reasonably believed to result in, the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to any Customer Data Processed by NW under the Agreement, whether or not the Customer Data includes Personal Data. Security Incidents include Personal Data Breaches as a subset.

1.8 “Restricted Transfer” means a transfer of Customer Personal Data from the European Economic Area, United Kingdom, or Switzerland to a country that does not benefit from an adequacy decision under the applicable Data Protection Law.

1.9 “SCCs” means the Standard Contractual Clauses approved by the European Commission in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller-to-Processor).

1.10 “Subprocessor” means a third party engaged by NW (or by NW’s Affiliate) to Process Customer Personal Data in connection with the Services. Software components that NW hosts and operates within its own infrastructure (e.g., open-source databases, runtimes, or agents running inside NW’s AWS environment) are not Subprocessors; the underlying infrastructure provider is the Subprocessor for those components.

1.11 “UK GDPR” means the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

1.12 “UK IDTA” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued under Section 119A of the UK Data Protection Act 2018 and in force as of 21 March 2022.

2. Scope and Roles

2.1 Scope. This DPA applies to NW’s Processing of Customer Personal Data in connection with the Services.

2.2 Roles.

For Customer Personal Data that NW Processes on Customer’s behalf, Customer is the Controller (or, as applicable, a Processor acting on behalf of another Controller) and NW is the Processor.
For Personal Data that NW Processes for its own business purposes (e.g., Customer’s business-contact information used to administer the Agreement, bill Customer, or communicate about the Services), each Party is an independent Controller of its own activities. This DPA does not apply to Processing for which NW is an independent Controller, except where expressly stated.

2.3 Compliance. Each Party will comply with its obligations under applicable Data Protection Laws.

3. NW’s Processing Obligations

3.1 Documented Instructions. NW will Process Customer Personal Data only (a) on Customer’s documented instructions as set forth in the Agreement, this DPA, and any further written instructions consistent with the Agreement; (b) as necessary to provide the Services; and (c) as required by law (in which case NW will, unless legally prohibited, inform Customer of the legal requirement before Processing).

3.1A Infringing Instructions. If NW believes that any instruction from Customer (including instructions set forth in the Agreement or this DPA) infringes any applicable Data Protection Law, NW will inform Customer without undue delay and, to the extent legally permitted, will not execute the instruction until Customer confirms or modifies it. This provision implements the requirement of GDPR Article 28(3) (last paragraph) and equivalent provisions of other Data Protection Laws.

3.2 Purpose Limitation. NW will not Process Customer Personal Data for any purpose other than those set forth in the Agreement, this DPA, and Schedule 1. For the avoidance of doubt, NW’s separate rights in System Data (as defined in Agreement §1.17), and NW’s permitted uses of System Data for security, product, operations management, research and development, threat intelligence, and improvement of the Platform (as set forth in Agreement §6.4), are not Processing of Customer Personal Data within the meaning of this §3.2, provided NW operates those rights consistent with Agreement §§1.17, 6.3, 6.4, and DPA §3.3 — including the requirement that System Data not identify Customer or any individual associated with Customer and that no Customer Personal Data be incorporated into any improvement made available to third parties.

3.3 No AI Training on Customer Personal Data. NW shall not use Customer Personal Data to train, fine-tune, or otherwise improve any machine-learning or artificial-intelligence model that is made available to any other customer or third party. Tenant-scoped fine-tunes or memory made available only to Customer within Customer’s own tenant are not a breach of this §3.3, provided the resulting artifact is never made available to any other customer. This restriction is a material term of the Agreement and this DPA and is incorporated by cross-reference from §6.3 of the Agreement.

3.4 Confidentiality. NW will ensure that any personnel authorized to Process Customer Personal Data are subject to appropriate obligations of confidentiality.

3.5 Security and Insurance. NW will implement and maintain the technical and organizational measures set forth in the Security Addendum at https://necessityworks.com/legal/security-addendum, which are designed to ensure a level of security appropriate to the risk of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. NW maintains commercial general liability, technology errors & omissions / cyber liability, and other insurance as set forth in Agreement §15, evidence of which is available to Customer on reasonable written request.

3.6 Assistance to Customer. Taking into account the nature of the Processing and the information available to NW, NW will provide reasonable assistance to Customer, at Customer’s expense, in:

responding to requests from Data Subjects to exercise their rights under Data Protection Laws;
complying with Customer’s data-protection impact assessment and consultation obligations (GDPR Articles 35 and 36 or analogous provisions); and
complying with Customer’s obligations to respond to Supervisory Authority inquiries.

3.7 Records. NW will maintain records of its Processing activities as required by Article 30(2) of the GDPR or equivalent law, and will make those records available to Customer on reasonable request solely to demonstrate compliance with this DPA.

3.8 Customer Obligations and Warranties. Customer represents and warrants that:

it has all necessary rights, lawful bases, consents, and authorizations under Data Protection Laws to provide Customer Personal Data to NW for the Processing contemplated by the Agreement and this DPA, including (where required) the right to engage NW as a Processor and to authorize the Processing categories described in Schedule 1;
its instructions to NW (whether through configuration of the Platform, written direction, or otherwise) are lawful and consistent with Data Protection Laws;
it will not upload, transmit, or otherwise cause NW to Process any Special Categories of Personal Data (as defined in GDPR Article 9), any data relating to criminal convictions or offenses (GDPR Article 10), any Protected Health Information unless a BAA is in effect, any Children’s Personal Data subject to COPPA or GDPR Article 8, or any other category requiring heightened protection, without NW’s prior written approval that such Processing can be supported by the Platform consistent with applicable law;
it will provide all required notices to, and obtain all required consents from, Data Subjects whose Personal Data it provides to NW; and
it will respond promptly to Data Subject requests for which Customer is responsible as Controller.

Customer’s breach of this §3.8 does not relieve NW of its Processor obligations under this DPA, but may affect the allocation of liability under §11 and may give rise to indemnification to the extent set forth in the Agreement.

4. Subprocessors

4.1 General Authorization. Customer authorizes NW to engage Subprocessors to Process Customer Personal Data, subject to this §4.

4.2 Current Subprocessors. NW’s current Subprocessors are published, and maintained as the authoritative single source of truth, at https://necessityworks.com/legal/subprocessors. Customer may subscribe to email notifications of changes to the list by following the instructions at that URL.

4.3 Notice of New Subprocessors. NW will provide Customer with at least thirty (30) days’ prior notice before authorizing a new Subprocessor (or expanding the scope of an existing Subprocessor’s Processing) by (a) updating the published Subprocessor list at https://necessityworks.com/legal/subprocessors and (b) sending an email notification to subscribers of the Subprocessor change-notification list (subscription instructions are published at the same URL). Customer is responsible for maintaining its subscription to the change-notification list.

4.4 Right to Object. Customer may object, in writing and on reasonable data-protection grounds, to a proposed new Subprocessor within the notice period. If Customer objects, the Parties will discuss the objection in good faith. If NW cannot reasonably accommodate the objection, Customer may, as its sole remedy, terminate the affected portion of the Services on written notice and receive a pro-rata refund of pre-paid, unused fees for the terminated portion.

4.5 Flow-Down. NW will enter a written agreement with each Subprocessor that imposes data-protection obligations substantially equivalent to those in this DPA. NW remains liable to Customer for any Subprocessor’s acts and omissions to the same extent as if performed by NW.

5. International Data Transfers

5.1 Transfer Mechanism. Where the Processing of Customer Personal Data involves a Restricted Transfer, the Parties will rely on one or more of the following transfer mechanisms, in the order listed:

An adequacy decision under the applicable Data Protection Law;
NW’s valid certification under a recognized data-transfer framework (e.g., the EU-U.S. Data Privacy Framework, UK Extension to the DPF, or Swiss-U.S. DPF);
The SCCs (for EEA transfers), UK IDTA (for UK transfers), or Swiss-specific SCC addendum (for Swiss transfers), as set forth in Schedule 4; or
An alternative transfer mechanism lawfully relied upon by NW with notice to Customer.

5.2 SCCs Incorporation. Where the SCCs apply, they are hereby incorporated into this DPA with the modules, options, and Annexes set forth in Schedule 4.

5.3 Government Access Requests. NW will handle legally binding requests from public authorities for Customer Personal Data in accordance with §7 (Compelled Disclosure) of this DPA and with Clause 15 of the SCCs (where the SCCs apply).

6. Data Subject Rights

6.1 Data Subject Requests. Taking into account the nature of the Processing, NW will provide Customer with the technical and organizational measures necessary for Customer to respond to requests from Data Subjects to exercise their rights under Data Protection Laws.

6.2 Direct Requests to NW. If NW receives a Data Subject request relating to Customer Personal Data directly from the Data Subject, NW will (a) not respond substantively except as directed by Customer or required by law, and (b) promptly notify Customer of the request unless legally prohibited.

7. Compelled Disclosure

7.1 Legal Process. If NW receives a legally binding request from a public authority or court for Customer Personal Data, NW will, to the extent legally permitted:

promptly notify Customer in writing;
challenge the request if, in NW’s reasonable assessment, a basis exists to do so;
in any event, disclose only the minimum Customer Personal Data legally required.

7.2 Transparency. NW will publish transparency reporting (aggregate, non-Customer-specific) regarding government access requests on an annual basis where legally permitted.

8. Security Incident and Personal Data Breach Notification

8.1 Notification Timeline. NW will notify Customer without undue delay, and in no event later than forty-eight (48) hours after NW’s confirmation of a Security Incident affecting Customer Data (whether or not the Customer Data includes Personal Data). Where the Security Incident is also a Personal Data Breach, the same notification will identify it as such so that Customer can assess its Data Protection Law obligations to Supervisory Authorities and Data Subjects.

8.2 Content of Notification. The notification will include, to the extent then known:

a description of the nature of the Security Incident, including the categories and approximate number of records affected and (where Personal Data is involved) the categories and approximate number of Data Subjects;
the likely consequences of the Security Incident;
the measures taken or proposed to address the Security Incident and mitigate its possible adverse effects; and
a point of contact for Customer’s further inquiries.

8.3 Further Information. If all of the above information cannot be provided in the initial notification, NW will provide updates as information becomes available, without undue delay.

8.4 Cooperation. NW will cooperate with Customer, at Customer’s expense, in the investigation and remediation of Security Incidents (including Personal Data Breaches) and in Customer’s fulfillment of any notification obligations to Supervisory Authorities, Data Subjects, or other regulators.

9. Audit

9.1 Information. NW will make available to Customer, upon reasonable written request, all information necessary to demonstrate compliance with this DPA, including:

NW’s then-current SOC 2 Type II report (or equivalent) and other published certifications;
NW’s completed, industry-standard security questionnaire; and
a summary of NW’s most recent penetration test, subject to reasonable redactions.

9.2 Audits and Inspections. To the extent that the information provided under §9.1 does not reasonably enable Customer to demonstrate compliance under applicable Data Protection Law, and subject to Customer’s payment of NW’s reasonable costs:

Customer may conduct an audit of NW’s compliance with this DPA no more than once per calendar year, on at least thirty (30) days’ prior written notice, during NW’s normal business hours, by a mutually agreed independent auditor bound by confidentiality obligations at least as protective as those in the Agreement.
Additional audits are permitted, at Customer’s expense, following a confirmed material Personal Data Breach affecting Customer Personal Data, on the same terms.
Audits will be limited in scope to NW’s Processing of Customer Personal Data and will not include access to (i) other customers’ Personal Data, (ii) NW’s source code (unless reasonably necessary to demonstrate a specific compliance matter and subject to heightened confidentiality), or (iii) NW’s commercially sensitive information unrelated to Customer Personal Data.

9.3 Remediation. If an audit identifies a material non-compliance, NW will use commercially reasonable efforts to remediate within a mutually agreed timeframe.

10. Deletion and Return

10.1 During the Term. During the Term, Customer may export Customer Personal Data in machine-readable format using the Platform’s export features.

10.2 Upon Termination. Upon termination or expiration of the Agreement:

NW will make Customer Personal Data available for export for thirty (30) days after the effective date of termination;
NW will thereafter delete or anonymize Customer Personal Data within sixty (60) days, except where retention is required by law (e.g., retention of financial records or response to active legal hold); and
on Customer’s written request, NW will provide written certification of deletion.

10.3 Backups. Copies of Customer Personal Data that persist in routine, non-targeted automated backup systems will be overwritten in the ordinary course; such copies remain subject to this DPA until overwritten.

11. Liability

Each Party’s liability under or in connection with this DPA is subject to the liability limitations set forth in §12 of the Agreement, including the super-cap exceptions in §12.3. Nothing in this DPA limits or excludes liability that cannot lawfully be limited or excluded under Data Protection Laws, including a Party’s liability to Data Subjects under the SCCs.

12. General

12.1 Precedence. In the event of a conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA controls. In the event of a conflict between the SCCs (where applicable) and this DPA, the SCCs control.

12.2 Term. This DPA commences on the effective date of the Agreement and continues for as long as NW Processes Customer Personal Data on Customer’s behalf.

12.3 Updates. NW may update this DPA from time to time to reflect changes in Data Protection Laws, operational requirements, or approved transfer mechanisms. NW will notify Customer of material adverse changes at least thirty (30) days before they take effect. Customer’s continued use of the Services after the effective date constitutes acceptance of the updated DPA, subject to Customer’s termination right in §18(m) of the Agreement.

12.4 Counterparts; Electronic Signatures. This DPA may be executed in counterparts, and electronic signatures have the same force and effect as original signatures.

ACCEPTANCE

This DPA does not require a separate signature. It is binding on the Parties by operation of the Agreement, which incorporates this DPA by reference. A Customer that requires a signed counterpart of this DPA may request one in writing to [email protected] under the same procedure described in the Agreement’s ACCEPTANCE section; a signed counterpart is evidentiary only and does not modify the substantive terms of this DPA.

SCHEDULE 1 — Processing Details

Subject matter of Processing: Provision of the Platform and Professional Services as described in the Agreement and applicable Order Forms and SOWs.

Duration of Processing: The Term of the Agreement, plus the deletion period specified in §10.

Nature and purpose of Processing: Hosting, storing, transmitting, displaying, analyzing, and deriving security insights from Customer Data for the purpose of providing the Services.

Types of Personal Data Processed: As determined by Customer’s use of the Platform. Typically includes:

Business-contact information (name, title, email, phone) of Customer’s Authorized Users and business contacts;
Employee and contractor identifiers used in Customer’s security-event data (usernames, employee IDs, role designations);
IP addresses, device identifiers, and network metadata;
Content of log events, alerts, tickets, and other Customer-configured telemetry that may incidentally include Personal Data;
Customer-selected AI prompts and chat content directed to the MAAV assistant, which may contain Personal Data.

Categories of Data Subjects:

Customer’s employees, contractors, and Authorized Users;
Customer’s own customers or end users, to the extent their identifiers appear in Customer’s security telemetry or are uploaded by Customer;
Third parties whose identifiers appear in Customer’s security-event data (e.g., threat actors, external vendors).

Special Categories of Personal Data: None intended. Customer shall not upload, transmit, or otherwise cause NW to Process Special Categories of Personal Data (as defined in GDPR Article 9), data relating to criminal convictions or offenses (GDPR Article 10), Protected Health Information (unless a BAA is in effect), Children’s Personal Data subject to COPPA or GDPR Article 8, or any other category requiring heightened protection under Data Protection Laws, without NW’s prior written approval that such Processing can be supported by the Platform consistent with applicable law. Customer’s obligations under this paragraph mirror DPA §3.8(c).

Frequency of Processing: Continuous during the Term.

Retention: As specified in §10 of this DPA, unless Customer configures earlier retention limits via the Platform.

SCHEDULE 2 — Subprocessors

NW maintains a single, authoritative, public list of all Subprocessors engaged to Process Customer Personal Data at:

https://necessityworks.com/legal/subprocessors

That URL is the sole source of truth for Subprocessor identity, purpose of Processing, and location. NW updates the URL whenever it adds, replaces, or removes a Subprocessor, subject to the notice and objection procedure in §4. Customer may subscribe to email notifications of changes by following the instructions at the URL.

For the avoidance of doubt and consistent with §1.10, software components that NW hosts and operates within its own AWS infrastructure (e.g., open-source databases, runtimes, or agents running inside NW’s environment) are not Subprocessors and do not appear on the published list; the underlying infrastructure provider (AWS) is the Subprocessor for those components.

SCHEDULE 3 — Jurisdiction-Specific Terms

3.1 European Economic Area (EEA) and Switzerland

The SCCs (Module Two, Controller-to-Processor) govern Restricted Transfers from the EEA. Schedule 4 sets forth the Annexes.
For Swiss transfers, references to the GDPR in the SCCs are deemed to include references to the Swiss Federal Act on Data Protection, and references to the competent Supervisory Authority are deemed to include the Swiss Federal Data Protection and Information Commissioner.

3.2 United Kingdom

Restricted Transfers from the UK are governed by the UK IDTA, which is hereby incorporated and is populated by reference to the SCCs and the information in Schedule 4, with UK-specific amendments per the UK IDTA template.

3.3 United States — State Comprehensive Privacy Laws (Aggregate)

For Processing subject to any U.S. state comprehensive privacy law — including (without limitation) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, the Utah Consumer Privacy Act, the Delaware Personal Data Privacy Act, and any successor, analogous, or equivalent statute — NW is a “service provider,” “contractor,” “processor,” or analogous role with respect to Customer Personal Data, and not a “third party,” controller, or independent decisionmaker. NW will not:

sell or share Customer Personal Data, as each of those terms is defined under the applicable U.S. state privacy law (and as further reinforced by MSA §6.4);
retain, use, or disclose Customer Personal Data for any purpose other than the Business Purposes set forth in the Agreement and this DPA, including the specific Processing purposes in Schedule 1;
retain, use, or disclose Customer Personal Data outside the direct business relationship between NW and Customer; or
combine Customer Personal Data with Personal Data received from another source (e.g., from another customer or NW’s own activities), except as expressly permitted to provide the Services or as expressly permitted under the applicable U.S. state privacy law.

NW certifies its understanding of, and compliance with, the restrictions in this §3.3. These commitments supplement (and do not displace) the broader anti-sale, anti-data-brokerage, and System-Data restrictions in MSA §6.3 and §6.4.

3.4 California (CCPA) — Specific Provisions

NW is a Service Provider (or, as applicable, a Contractor) under the CCPA. NW will not (a) sell or share Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than the Business Purposes specified in the Agreement, (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between NW and Customer, or (d) combine Customer Personal Data with Personal Data received from another source except as expressly permitted by the CCPA.
NW certifies that it understands and will comply with these restrictions.

3.5 Canada (PIPEDA)

NW will Process Customer Personal Data in accordance with PIPEDA and any applicable provincial privacy legislation, including Quebec’s Act respecting the protection of personal information in the private sector. NW’s Subprocessors are bound by contractual obligations substantially equivalent to those in this DPA.

3.6 Other jurisdictions

For Processing governed by other Data Protection Laws, the Parties will negotiate in good faith such additional terms as are necessary for compliance.

SCHEDULE 4 — Standard Contractual Clauses (SCCs) and UK IDTA

Part A — Standard Contractual Clauses (Module Two: Controller-to-Processor)

The SCCs are incorporated into this DPA with the following options and Annexes:

Clause 7 (Docking Clause): Applies. Other entities may accede to the SCCs in accordance with Clause 7.

Clause 9(a) (Subprocessors): Option 2 (General written authorisation) applies. NW may engage Subprocessors pursuant to the general authorization in §4 of this DPA, subject to the 10-day notice period and Customer’s right to object.

Clause 11(a) (Independent dispute resolution): The optional language is not selected.

Clause 13(a)/Annex I.C (Competent Supervisory Authority): The competent Supervisory Authority is determined in accordance with Clause 13(a) based on the Customer’s establishment in the EEA. Where Customer has no establishment in the EEA but has appointed a representative under Article 27 GDPR, the Supervisory Authority in the Member State of that representative applies. Otherwise, the Supervisory Authority in Ireland applies.

Clause 17 (Governing law): Option 1 applies. The SCCs are governed by the law of Ireland.

Clause 18(b) (Jurisdiction): The courts of Ireland.

Annex I.A — List of Parties

Data Exporter: Customer, as identified in the Agreement.
Data Importer: NecessityWorks, Inc., 2810 N Church St #550982, Wilmington, DE 19802-4447.

Annex I.B — Description of Transfer

As set forth in Schedule 1 of this DPA.

Annex I.C — Competent Supervisory Authority

As specified above.

Annex II — Technical and Organisational Measures

As set forth in the Security Addendum.

Annex III — List of Sub-processors

As set forth in Schedule 2 of this DPA, as updated at https://necessityworks.com/legal/subprocessors.

Part B — UK International Data Transfer Addendum (IDTA)

The UK IDTA is hereby incorporated and populated as follows:

Table 1 (Parties): As set forth in Annex I.A above.
Table 2 (Selected SCCs, Modules, and Selected Clauses): Module Two (Controller-to-Processor), with the options and Annexes set forth in Part A above.
Table 3 (Appendix Information): As set forth in the Annexes to Part A above and in Schedules 1 and 2 of this DPA.
Table 4 (Ending the Addendum when the Approved Addendum Changes): Neither Party may end the UK IDTA on the grounds of changes to the Approved Addendum, except as provided in the UK IDTA itself.

Part C — Swiss Amendments

For Restricted Transfers from Switzerland: - References in the SCCs to “GDPR” are deemed to also reference the Swiss Federal Act on Data Protection; - References to “Member State” are deemed to include Switzerland; - The competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner.