Standard Data Processing Agreement Template for Austria

A Standard Data Processing Agreement is required whenever an organization (the data controller) engages a service provider (the data processor) to process personal data on its behalf. This document, governed by Austrian law, ensures compliance with Article 28 of the GDPR and the Austrian Data Protection Act (DSG). It is essential for any service relationship involving personal data processing, from cloud services to payroll processing. The agreement details processing instructions, security requirements, confidentiality obligations, sub-processor management, and incident handling procedures. It must be in place before any processing begins and should be regularly reviewed to ensure continued compliance with Austrian and EU data protection requirements.

1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses

2. Background: Context of the processing relationship and reference to the main service agreement

3. Definitions: Key terms used in the agreement, including GDPR-specific terminology and agreement-specific definitions

4. Scope and Purpose of Processing: Detailed description of the data processing activities, categories of data subjects, types of personal data, and processing purposes

5. Duration: Term of the DPA and its relationship to the main service agreement

6. Obligations of the Processor: Core processor obligations under GDPR Article 28, including processing only on documented instructions

7. Obligations of the Controller: Controller's responsibilities and obligations regarding instructions and compliance

8. Security Measures: Technical and organizational measures implemented to ensure appropriate security

9. Sub-processing: Conditions and requirements for engaging sub-processors

10. Data Subject Rights: Processor's obligations to assist with data subject requests

11. Data Breach Notification: Procedures and timeframes for reporting personal data breaches

12. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

13. Data Return and Deletion: Obligations regarding data handling upon agreement termination

14. Liability and Indemnification: Allocation of responsibilities and liabilities between parties

15. Governing Law and Jurisdiction: Specification of Austrian law and jurisdiction