Intercompany Data Processing Agreement Template for Austria

The Intercompany Data Processing Agreement is essential for corporate groups operating in Austria that engage in intra-group processing of personal data. This document is required when one group entity (acting as a data controller) engages another group entity (acting as a data processor) to process personal data on its behalf. The agreement ensures compliance with Article 28 of the GDPR and the Austrian Data Protection Act (DSG), while considering the specific context of affiliated companies. It covers processing activities, security measures, data breach procedures, audit rights, and liability allocation between group entities. The document is particularly important for international corporate groups with Austrian operations, as it must address both local requirements and EU-wide data protection standards.

1. Parties: Identification of the group companies involved - controller entity and processor entity

2. Background: Context of the intercompany relationship and purpose of the data processing agreement

3. Definitions: Key terms used in the agreement, including GDPR-specific terminology and company group-specific terms

4. Scope and Purpose of Processing: Detailed description of the data processing activities, categories of data, and processing purposes

5. Duration of Processing: Term of the agreement and processing activities

6. Obligations of the Processor: Processor's duties under GDPR Article 28, including processing only on documented instructions

7. Obligations of the Controller: Controller's responsibilities and requirements for lawful instructions

8. Confidentiality: Confidentiality obligations for the processing of personal data and business information

9. Technical and Organizational Measures: Security measures implemented to ensure appropriate level of data protection

10. Sub-processing: Conditions and requirements for engaging sub-processors within or outside the company group

11. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

12. Personal Data Breach: Notification requirements and procedures in case of data breaches

13. Audit Rights: Controller's audit rights and processor's cooperation obligations

14. Return or Deletion of Data: Obligations regarding personal data at the end of processing activities

15. Liability and Indemnification: Allocation of liability between group companies and indemnification provisions

16. Governing Law and Jurisdiction: Austrian law as governing law and jurisdiction provisions