Data Processing Agreement

Data Processing Agreement

Effective date: 7 October 2026
Last updated: 7 October 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between Pak Legal Desk (“Processor” or “we”) and any business customer, law firm, or enterprise client (“Controller” or “you”) that engages us to process personal data on your behalf.

This DPA is provided in compliance with Article 28 of the EU General Data Protection Regulation (EU 2016/679) and, where applicable, the UK GDPR.

1. Scope and Roles

Where Pak Legal Desk processes personal data on behalf of a Controller in connection with the Services, Pak Legal Desk acts as a Processor and the Controller acts as the Controller of that data. The subject matter, duration, nature, and purpose of the processing are set out in the underlying services agreement.

2. Obligations of the Processor

Pak Legal Desk agrees to:

• Process personal data only on documented instructions from the Controller;
• Ensure that persons authorised to process the data are bound by confidentiality;
• Implement appropriate technical and organisational security measures under Article 32 GDPR;
• Assist the Controller in responding to data subject requests;
• Notify the Controller without undue delay upon becoming aware of a personal data breach;
• Delete or return personal data at the end of the provision of services, unless required to retain it by law;
• Make available all information necessary to demonstrate compliance;
• Engage sub-processors only with the Controller’s authorisation and under written contract.

3. Sub-Processors

The Controller authorises Pak Legal Desk to engage the following categories of sub-processors:

• Hosting providers (server infrastructure)
• Payment gateways (JazzCash, EasyPaisa, banks)
• Email and communication service providers
• Analytics providers (Google)

Pak Legal Desk will inform the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

4. International Transfers

Where personal data of EU or UK data subjects is transferred outside the EEA or the UK, the parties rely on the European Commission’s Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum as appropriate.

5. Security Measures

Pak Legal Desk implements the following security measures:

• Encryption in transit (HTTPS / TLS 1.2 or higher)
• Hashed password storage (bcrypt or equivalent)
• Role-based access controls
• Regular security updates
• Secure payment handling via PCI-compliant gateways
• Logging and monitoring of access to personal data

6. Data Subject Rights

Pak Legal Desk will assist the Controller in responding to requests from data subjects exercising their rights under GDPR, CCPA/CPRA, UAE PDPL, or other applicable laws. Requests received directly by Pak Legal Desk will be forwarded to the Controller without undue delay.

7. Breach Notification

In the event of a personal data breach, Pak Legal Desk will notify the Controller within 48 hours of becoming aware of the breach, providing details of the nature of the breach, the categories and approximate number of data subjects affected, and the measures taken or proposed.

8. Audit Rights

The Controller may, at its own cost and with reasonable notice, audit Pak Legal Desk’s compliance with this DPA, not more than once per year unless required by a supervisory authority.

9. Liability

Liability under this DPA is subject to the limitation of liability in the underlying services agreement, to the extent permitted by law.

10. Governing Law

This DPA is governed by the laws of the Islamic Republic of Pakistan. Where GDPR applies, the mandatory provisions of EU law prevail.

11. Contact

Data Protection Officer: Mehrab Ali Khan — [email protected]