Order Data Processing Agreement Template for Austria

This Order Data Processing Agreement is essential whenever an organization (controller) engages a service provider (processor) to process personal data on its behalf under Austrian jurisdiction. The agreement is mandated by Article 28 of the GDPR and Austrian data protection law, serving as a crucial compliance document that defines the rights and obligations of both parties in relation to personal data processing. It covers essential aspects such as the scope of processing, security measures, confidentiality obligations, and procedures for data breaches. The document ensures that both parties maintain compliance with Austrian and EU data protection requirements while establishing clear accountability and liability frameworks. It is particularly important for organizations operating in Austria or processing data of Austrian residents, as it incorporates specific national legal requirements alongside GDPR obligations.

1. Parties: Identification of the data controller and data processor, including full legal names, registration details, and authorized representatives

2. Background: Context of the agreement, relationship between parties, and general purpose of the data processing activities

3. Definitions: Key terms used in the agreement, including those from GDPR Article 4 and any additional contract-specific terms

4. Scope and Purpose of Processing: Detailed description of the processing activities, purposes, and categories of personal data to be processed

5. Duration of Processing: Timeframe of the processing activities and conditions for termination

6. Obligations of the Processor: Core responsibilities of the processor including processing only on documented instructions, confidentiality, security measures, and assistance obligations

7. Sub-processors: Conditions and requirements for engaging sub-processors, including authorization process and obligations

8. Technical and Organizational Measures: Security measures implemented to ensure appropriate level of data protection

9. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests

10. Personal Data Breach: Notification requirements and procedures in case of data breaches

11. Audit Rights: Controller's rights to audit and processor's obligations to contribute to audits

12. Data Return and Deletion: Obligations regarding return or deletion of personal data upon termination

13. Liability and Indemnification: Allocation of responsibility and liability between parties

14. Governing Law and Jurisdiction: Specification of Austrian law as governing law and jurisdiction for disputes