Commissioned Data Processing Agreement Template for Austria

The Commissioned Data Processing Agreement is a mandatory legal document required under Article 28 of the GDPR and Austrian data protection law whenever an organization (controller) engages another party (processor) to process personal data on its behalf. This agreement is essential for ensuring compliance with European and Austrian data protection requirements, establishing clear lines of responsibility, and implementing appropriate safeguards for personal data processing. It must be in place before any data processing begins and should detail the scope, purpose, and nature of processing, along with technical and organizational measures for data protection. The agreement is particularly crucial in the Austrian context as it must comply with both GDPR and specific requirements under the Austrian Data Protection Act (DSG), including local regulatory guidance and enforcement practices.

1. Parties: Identification of the data controller and data processor, including full legal names and registration details

2. Background: Context of the processing relationship and purpose of the agreement

3. Definitions: Key terms used in the agreement, including GDPR-specific terminology

4. Subject Matter and Duration: Scope of processing activities and duration of the agreement

5. Nature and Purpose of Processing: Detailed description of processing activities and their intended purposes

6. Type of Personal Data and Categories of Data Subjects: Specification of personal data types and affected individuals

7. Obligations and Rights of the Controller: Controller's responsibilities, including instructions and monitoring rights

8. Processor's Obligations: Core processor duties including security measures, confidentiality, and subprocessing rules

9. Technical and Organizational Measures: Security measures implemented to ensure appropriate data protection

10. Sub-processing: Rules and procedures for engaging sub-processors

11. Data Subject Rights: Processor's assistance in responding to data subject requests

12. Data Breach Notification: Procedures and timeframes for reporting data breaches

13. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

14. Data Return and Deletion: Obligations regarding data handling upon agreement termination

15. Liability and Indemnification: Allocation of responsibilities and liability between parties

16. Termination: Conditions and procedures for ending the agreement

17. Governing Law and Jurisdiction: Specification of Austrian law application and jurisdictional matters