Controller To Controller Data Processing Agreement Template for Austria

The Controller To Controller Data Processing Agreement is essential when two organizations, acting as independent data controllers under EU GDPR and Austrian law, need to share personal data as part of their business operations. This document is crucial for establishing clear responsibilities and ensuring compliance with both the GDPR and the Austrian Data Protection Act (DSG). It should be used whenever two organizations independently determine the purposes and means of processing personal data and need to share that data with each other. The agreement covers critical aspects such as data security measures, breach notification procedures, data subject rights handling, and liability allocation. It's particularly important in the Austrian context as it incorporates specific national law requirements while maintaining GDPR compliance. The document serves as both a legal compliance tool and an operational framework for data sharing activities.

1. Parties: Identification of the two data controllers, including full legal names, registration details, and addresses

2. Background: Context of the agreement, nature of data sharing relationship, and general purpose of the processing activities

3. Definitions: Key terms used in the agreement, including those from GDPR and Austrian law, and agreement-specific definitions

4. Scope and Purpose of Data Processing: Detailed description of the data sharing arrangement, purposes of processing, and categories of data subjects and personal data

5. Roles and Responsibilities: Clear delineation of each controller's obligations, including primary processing responsibilities and compliance requirements

6. Legal Basis for Processing: Specification of the legal grounds under GDPR Article 6 for the processing activities of each controller

7. Data Protection Principles: Commitment to GDPR principles including lawfulness, fairness, transparency, purpose limitation, data minimization, and accuracy

8. Security Measures: Technical and organizational measures required to ensure appropriate security of the personal data

9. Data Subject Rights: Procedures for handling data subject requests and ensuring data subject rights are respected

10. Personal Data Breaches: Notification requirements and procedures in case of data breaches

11. Confidentiality: Obligations regarding confidentiality of shared personal data and business information

12. Term and Termination: Duration of the agreement and conditions for termination

13. Governing Law and Jurisdiction: Specification of Austrian law as governing law and jurisdiction for disputes