Data Protection Addendum Template for Austria

The Data Protection Addendum (DPA) is essential for organizations engaging in personal data processing activities under Austrian jurisdiction. It is specifically required when one party (the processor) processes personal data on behalf of another party (the controller), as mandated by Article 28 of the GDPR and the Austrian Data Protection Act. The document supplements existing service agreements by incorporating necessary data protection provisions, including processing instructions, security measures, breach notification procedures, and audit rights. This DPA is particularly crucial for international businesses operating in Austria or processing data of Austrian residents, as it must comply with both EU-wide GDPR requirements and specific Austrian data protection regulations. The document should be implemented before any data processing activities commence and updated as necessary to reflect changes in processing activities or regulatory requirements.

1. Parties: Identification of the data controller and data processor, including full legal names and registration details

2. Background: Context of the DPA, reference to the main agreement, and purpose of the addendum

3. Definitions: Key terms used in the DPA, including GDPR-specific terminology and alignment with Austrian DSG definitions

4. Scope and Purpose of Processing: Detailed description of the data processing activities, categories of data subjects, and types of personal data

5. Duration of Processing: Timeframe for data processing activities, aligned with the main agreement's term

6. Obligations of the Processor: Processor's duties under GDPR Article 28, including processing only on documented instructions

7. Obligations of the Controller: Controller's responsibilities, including providing documented instructions and ensuring lawful basis for processing

8. Technical and Organizational Measures: Security measures implemented to protect personal data

9. Sub-processing: Conditions and requirements for engaging sub-processors

10. Data Subject Rights: Procedures for assisting with data subject requests

11. Personal Data Breach: Breach notification procedures and timelines

12. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

13. Data Return and Deletion: Obligations regarding data handling upon agreement termination

14. Liability and Indemnities: Allocation of responsibilities and liabilities between parties

15. Governing Law and Jurisdiction: Confirmation of Austrian law application and jurisdiction