The Data Processing Addendum is a critical document required whenever an organization (the controller) engages another party (the processor) to process personal data on its behalf. This document, governed by German law, ensures compliance with both the GDPR and the German Federal Data Protection Act (BDSG), establishing specific obligations, technical requirements, and safeguards for data processing activities. It must be implemented before any data processing begins and should be regularly reviewed to ensure ongoing compliance. The DPA includes detailed provisions for data security measures, breach notification procedures, sub-processor engagement, international data transfers, and audit rights, tailored to meet the stringent requirements of German data protection law.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Your data doesn't train 蜜桃传媒's AI
You keep IP ownership聽of your docs
Alternatively...
1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses
2. Background: Context of the agreement, reference to the main service agreement, and purpose of the DPA
3. Definitions: Key terms used in the agreement, including those from GDPR and German law (BDSG)
4. Scope and Purpose of Processing: Detailed description of the data processing activities, categories of data subjects and personal data
5. Duration: Term of the DPA, typically linked to the main agreement's duration
6. Obligations of the Processor: Core processor obligations under GDPR Art. 28 and BDSG, including processing only on documented instructions
7. Obligations of the Controller: Controller's responsibilities, including providing documented instructions and ensuring legal basis for processing
8. Technical and Organizational Measures: Security measures implemented to ensure appropriate level of data protection
9. Sub-processing: Conditions and requirements for engaging sub-processors
10. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests
11. Data Protection Impact Assessment: Cooperation requirements for DPIAs and prior consultations
12. Data Breach Notification: Procedures and timeframes for reporting personal data breaches
13. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance
14. Data Return and Deletion: Obligations regarding data handling upon agreement termination
15. Liability and Indemnification: Allocation of responsibility and liability between parties
1. International Data Transfers: Required when personal data may be transferred outside the EEA, incorporating EU SCCs and additional safeguards
2. Sector-Specific Requirements: Additional provisions for specific sectors (e.g., healthcare, telecommunications) under German law
3. Joint Controller Provisions: Required when the relationship includes elements of joint controllership
4. Data Protection Officer: Specific provisions when either party has appointed a DPO under GDPR or BDSG requirements
5. Insurance Requirements: Specific insurance obligations for data protection risks
6. Emergency Protocols: Special procedures for emergency processing situations
1. Schedule 1 - Processing Activities: Detailed description of processing activities, including categories of data, purposes, and duration
2. Schedule 2 - Technical and Organizational Measures: Detailed description of security measures implemented by the processor
3. Schedule 3 - Approved Sub-processors: List of pre-approved sub-processors and their processing activities
4. Schedule 4 - Transfer Mechanisms: Details of transfer mechanisms for international data transfers, including SCCs if applicable
5. Schedule 5 - Security Breach Response Plan: Detailed procedures for handling and reporting data breaches
6. Appendix A - Contact Details: Contact information for key personnel, including data protection officers and emergency contacts
7. Appendix B - Audit Procedures: Detailed procedures for conducting compliance audits
Authors
Find the document you need
Data Processing Contract
A German law-governed agreement establishing terms for GDPR-compliant personal data processing between controller and processor.
Download
Controller To Controller Agreement
A German law-governed agreement establishing joint processing arrangements between two or more data controllers under GDPR and BDSG requirements.
Download
Joint Controller Agreement
A German law-governed agreement establishing shared data protection responsibilities between joint controllers under GDPR Article 26 and BDSG requirements.
Download
Standard Data Processing Agreement
A German law-governed Data Processing Agreement ensuring GDPR compliance for personal data processing between controller and processor.
Download
Data Processing Addendum
A German law-compliant Data Processing Addendum that establishes terms for personal data processing under GDPR and BDSG requirements.
Download
Intra Group Data Transfer Agreement
German law-governed agreement regulating personal data transfers between group companies, ensuring GDPR and BDSG compliance.
Download
Intercompany Data Processing Agreement
German law-governed data processing agreement between group companies, compliant with GDPR and BDSG requirements.
Download
Data Transfer Addendum
German law-governed Data Transfer Addendum ensuring GDPR compliance and German BDSG requirements for secure personal data transfers between organizations.
Download
Personal Data Transfer Agreement
A German law-governed agreement for compliant transfer of personal data between parties, ensuring GDPR and BDSG compliance.
Download
骋别苍颈别鈥檚 Security Promise
蜜桃传媒 is the safest place to draft. Here鈥檚 how we prioritise your privacy and security.
Your data is private:
We do not train on your data; 骋别苍颈别鈥檚 AI improves independently
All data stored on 蜜桃传媒 is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it
