The Standard Data Processing Agreement is a mandatory legal document required under Article 28 of the GDPR and German data protection law whenever a company (controller) engages another party (processor) to process personal data on its behalf. This agreement is essential for businesses operating in or with German entities, ensuring compliance with both EU-wide and German-specific data protection requirements. The document establishes the processor's obligations regarding data security, confidentiality, sub-processing, and breach notification, while incorporating specific requirements of the German Federal Data Protection Act (BDSG). It includes detailed technical and organizational measures, audit rights, and data handling procedures, making it suitable for various processing activities while maintaining compliance with German legal standards.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Your data doesn't train 蜜桃传媒's AI
You keep IP ownership聽of your docs
Alternatively...
1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses
2. Background: Context of the processing relationship and reference to the main service agreement
3. Definitions: Key terms used in the agreement, including those from GDPR Article 4 and additional contract-specific terms
4. Scope and Purpose of Processing: Detailed description of the processing activities, categories of data, and processing purposes as required by GDPR Article 28(3)
5. Duration: Term of the processing agreement and its relationship to the main service agreement
6. Processor Obligations: Core obligations of the processor including processing only on documented instructions, confidentiality, security measures, and sub-processor requirements
7. Technical and Organizational Measures: General security obligations and reference to detailed measures in schedule
8. Sub-processing: Conditions and requirements for engaging sub-processors, including authorization process
9. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests
10. Data Breach Notification: Procedures and timeframes for notifying controller of personal data breaches
11. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance
12. Data Return and Deletion: Obligations regarding data handling upon agreement termination
13. Liability and Indemnification: Allocation of liability and indemnification obligations
14. Governing Law and Jurisdiction: Specification of German law as governing law and jurisdiction for disputes
1. International Data Transfers: Required when personal data will be transferred outside the EU/EEA, including transfer mechanisms and safeguards
2. Industry-Specific Compliance: Required for regulated industries like healthcare or finance, addressing specific regulatory requirements
3. Joint Controller Provisions: Required when the relationship includes aspects of joint controllership under GDPR Article 26
4. Data Protection Impact Assessment: Required when processing is likely to result in high risk to individuals' rights and freedoms
5. Insurance Requirements: Optional section specifying required insurance coverage for data protection incidents
6. Force Majeure: Optional section addressing circumstances beyond parties' control affecting data processing obligations
1. Schedule 1 - Processing Details: Detailed description of processing activities, including data categories, subjects, purposes, and duration
2. Schedule 2 - Technical and Organizational Measures: Detailed security measures implemented by the processor, including access controls, encryption, and backup procedures
3. Schedule 3 - Approved Sub-processors: List of pre-approved sub-processors and their processing activities
4. Schedule 4 - Transfer Mechanisms: Details of international transfer mechanisms where applicable, including SCCs or BCRs
5. Schedule 5 - Security Breach Response Plan: Detailed procedures for handling and reporting data breaches
6. Appendix A - Contact Details: Contact information for data protection officers, representatives, and key personnel
7. Appendix B - Audit Procedures: Detailed procedures for conducting compliance audits
Authors
Find the document you need
Data Processing Contract
A German law-governed agreement establishing terms for GDPR-compliant personal data processing between controller and processor.
Download
Controller To Controller Agreement
A German law-governed agreement establishing joint processing arrangements between two or more data controllers under GDPR and BDSG requirements.
Download
Joint Controller Agreement
A German law-governed agreement establishing shared data protection responsibilities between joint controllers under GDPR Article 26 and BDSG requirements.
Download
Standard Data Processing Agreement
A German law-governed Data Processing Agreement ensuring GDPR compliance for personal data processing between controller and processor.
Download
Data Processing Addendum
A German law-compliant Data Processing Addendum that establishes terms for personal data processing under GDPR and BDSG requirements.
Download
Intra Group Data Transfer Agreement
German law-governed agreement regulating personal data transfers between group companies, ensuring GDPR and BDSG compliance.
Download
Intercompany Data Processing Agreement
German law-governed data processing agreement between group companies, compliant with GDPR and BDSG requirements.
Download
Data Transfer Addendum
German law-governed Data Transfer Addendum ensuring GDPR compliance and German BDSG requirements for secure personal data transfers between organizations.
Download
Personal Data Transfer Agreement
A German law-governed agreement for compliant transfer of personal data between parties, ensuring GDPR and BDSG compliance.
Download
骋别苍颈别鈥檚 Security Promise
蜜桃传媒 is the safest place to draft. Here鈥檚 how we prioritise your privacy and security.
Your data is private:
We do not train on your data; 骋别苍颈别鈥檚 AI improves independently
All data stored on 蜜桃传媒 is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it
