Agreement On The Processing Of Personal Data Template for Austria

The Agreement On The Processing Of Personal Data is a crucial document required whenever an organization (data controller) engages another party (data processor) to process personal data on its behalf under Austrian jurisdiction. This agreement is mandated by Article 28 of the GDPR and the Austrian Data Protection Act (DSG), and must be in place before any data processing activities begin. It defines the scope of processing activities, establishes clear responsibilities and obligations of both parties, outlines security requirements, and ensures compliance with data protection laws. The document is particularly important as it provides legal protection for both parties and demonstrates compliance with regulatory requirements. It typically includes detailed technical and organizational measures, data breach procedures, and specific provisions for handling personal data in accordance with Austrian and EU law.

1. Parties: Identification of the Data Controller and Data Processor, including full legal names, registration numbers, and registered addresses

2. Background: Context of the relationship between the parties and purpose of the agreement

3. Definitions: Definitions of key terms used in the agreement, aligned with GDPR terminology

4. Scope and Purpose of Processing: Detailed description of what personal data will be processed and for what specific purposes

5. Duration of Processing: Timeline for the data processing activities and agreement validity

6. Nature and Purpose of Processing: Specific details about how the data will be processed and the legitimate basis for processing

7. Obligations of the Data Processor: Detailed responsibilities and commitments of the processor under GDPR Article 28

8. Obligations of the Data Controller: Responsibilities and commitments of the controller, including instructions for processing

9. Security Measures: Technical and organizational measures implemented to ensure data security

10. Sub-processing: Conditions and requirements for engaging sub-processors

11. Data Subject Rights: Procedures for handling data subject requests and ensuring their rights

12. Personal Data Breach: Procedures for handling and reporting data breaches

13. Audit Rights: Controller's rights to audit the processor's compliance

14. Termination: Conditions for termination and data handling upon termination

15. Governing Law and Jurisdiction: Specification of Austrian law as governing law and jurisdiction for disputes