Data Privacy Addendum Template for Austria

A Data Privacy Addendum is essential when one party processes personal data on behalf of another under Austrian jurisdiction. This document is typically used to supplement existing commercial agreements (such as service agreements, software licenses, or consulting contracts) where personal data processing is involved. It ensures compliance with the European General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), establishing clear protocols for data handling, security measures, and breach notifications. The addendum becomes particularly crucial when engaging service providers, implementing new data processing systems, or when Austrian organizations work with international partners. It should be customized based on the specific data processing activities, the sensitivity of the data involved, and any sector-specific requirements under Austrian law.

1. Parties: Identification of the data controller and data processor, including their registered details and representatives

2. Background: Context of the relationship between parties and reference to the main agreement this DPA supplements

3. Definitions: Key terms used in the DPA, aligned with GDPR and Austrian DSG definitions

4. Scope and Purpose: Details of the personal data processing activities covered by the agreement

5. Roles and Responsibilities: Clear delineation of parties' roles (controller/processor) and their respective obligations

6. Processing Instructions: Specific instructions for data processing, including permitted purposes and processing boundaries

7. Data Security Measures: Technical and organizational measures required to ensure appropriate security of personal data

8. Confidentiality: Obligations regarding confidentiality and training of personnel with data access

9. Sub-processing: Conditions and requirements for engaging sub-processors

10. Data Subject Rights: Procedures for handling data subject requests and required cooperation

11. Data Breach Notification: Procedures and timeframes for reporting personal data breaches

12. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

13. Term and Termination: Duration of the DPA and procedures for termination

14. Return or Deletion of Data: Obligations regarding personal data upon termination of services

15. Governing Law and Jurisdiction: Specification of Austrian law as governing law and jurisdiction for disputes