The Data Processing Contract is a mandatory legal requirement under Article 28 of the GDPR and German data protection law when a company (controller) engages another party (processor) to process personal data on its behalf. This document is essential for any business relationship involving personal data processing in Germany, establishing the framework for GDPR-compliant data handling. It details the scope of processing, security measures, confidentiality obligations, and incident response procedures. The agreement must comply with both EU-wide GDPR requirements and specific German national data protection laws, particularly the BDSG. It's typically used when engaging cloud service providers, IT contractors, payroll processors, or any third-party service provider that will handle personal data.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Your data doesn't train Genie's AI
You keep IP ownership of your docs
Alternatively...
1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses
2. Background: Context of the data processing relationship and brief description of services requiring data processing
3. Definitions: Definitions of key terms used in the agreement, including GDPR-specific terminology
4. Scope and Purpose of Processing: Detailed description of the permitted data processing activities and their specific purposes
5. Duration of Processing: Timeframe of the data processing activities and conditions for termination
6. Nature and Purpose of Processing: Detailed specification of how and why the data will be processed
7. Types of Personal Data: Categories of personal data to be processed
8. Categories of Data Subjects: Description of the groups of individuals whose data will be processed
9. Obligations of the Processor: Processor's duties including security measures, confidentiality, and subprocessing requirements
10. Obligations of the Controller: Controller's responsibilities including instructions, audits, and assistance obligations
11. Technical and Organizational Measures: Security measures required to ensure appropriate level of data protection
12. Subprocessing: Conditions and requirements for engaging subprocessors
13. Data Subject Rights: Procedures for handling data subject requests and ensuring their rights
14. Data Breach Notification: Procedures and timeframes for reporting data breaches
15. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance
16. Data Return and Deletion: Obligations regarding data handling upon contract termination
17. Liability and Indemnification: Allocation of responsibilities and liability between parties
18. Governing Law and Jurisdiction: Specification of German law application and jurisdiction
1. International Data Transfers: Required when personal data will be transferred outside the EEA, specifying transfer mechanisms
2. Special Categories of Data: Required when processing sensitive personal data, specifying additional safeguards
3. Data Protection Impact Assessment: Required when processing is likely to result in high risk to individuals
4. Industry-Specific Compliance: Required for specific sectors like healthcare or finance with additional regulatory requirements
5. Insurance Requirements: Specific insurance obligations for high-risk processing activities
6. Business Continuity: Required for critical processing activities requiring specific continuation measures
7. Exit Management: Detailed procedures for transition of services to another processor
1. Schedule 1 - Processing Activities: Detailed description of all processing activities, purposes, and data categories
2. Schedule 2 - Technical and Organizational Measures: Detailed description of security measures implemented by the processor
3. Schedule 3 - Approved Subprocessors: List of pre-approved subprocessors and their processing activities
4. Schedule 4 - Transfer Mechanisms: Details of mechanisms used for international data transfers if applicable
5. Schedule 5 - Security Breach Response Plan: Detailed procedures for handling and reporting security breaches
6. Schedule 6 - Audit Procedures: Specific procedures and requirements for conducting audits
7. Schedule 7 - Contact Details: Key contacts for both parties for various types of notices and communications
Authors
Find the document you need
Data Processing Contract
A German law-governed agreement establishing terms for GDPR-compliant personal data processing between controller and processor.
Download
Controller To Controller Agreement
A German law-governed agreement establishing joint processing arrangements between two or more data controllers under GDPR and BDSG requirements.
Download
Joint Controller Agreement
A German law-governed agreement establishing shared data protection responsibilities between joint controllers under GDPR Article 26 and BDSG requirements.
Download
Standard Data Processing Agreement
A German law-governed Data Processing Agreement ensuring GDPR compliance for personal data processing between controller and processor.
Download
Data Processing Addendum
A German law-compliant Data Processing Addendum that establishes terms for personal data processing under GDPR and BDSG requirements.
Download
Intra Group Data Transfer Agreement
German law-governed agreement regulating personal data transfers between group companies, ensuring GDPR and BDSG compliance.
Download
Intercompany Data Processing Agreement
German law-governed data processing agreement between group companies, compliant with GDPR and BDSG requirements.
Download
Data Transfer Addendum
German law-governed Data Transfer Addendum ensuring GDPR compliance and German BDSG requirements for secure personal data transfers between organizations.
Download
Personal Data Transfer Agreement
A German law-governed agreement for compliant transfer of personal data between parties, ensuring GDPR and BDSG compliance.
Download
ұԾ’s Security Promise
Genie is the safest place to draft. Here’s how we prioritise your privacy and security.
Your data is private:
We do not train on your data; ұԾ’s AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it
