Controller To Controller Agreement Template for Germany

A Controller To Controller Agreement is a legally binding document that governs the relationship between two or more organizations that jointly determine the purposes and means of processing personal data. Under German data protection law, this agreement is mandatory when organizations engage in joint processing activities, ensuring compliance with both the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz).

When do you need this document?

You need this agreement when your organization collaborates with other entities in ways that involve shared personal data processing. Common scenarios include joint marketing campaigns where customer databases are combined, shared research projects involving participant data, collaborative service platforms where multiple companies access the same user information, and business partnerships where customer or employee data is exchanged. German companies must also establish these agreements when working with international partners who process data of German residents, particularly given Germany's active enforcement of data protection regulations.

Key legal considerations

The agreement must clearly define each controller's specific responsibilities under GDPR Article 26, including who handles data subject requests, breach notifications, and regulatory communications. You must establish transparent arrangements for data subjects regarding their rights and how to exercise them. The document should specify data security measures, retention periods, and deletion procedures that both parties will implement. Liability allocation is crucial – you need to determine how responsibility is shared for potential data protection violations and associated penalties. The agreement must also address data transfer mechanisms if one controller is outside the EU, potentially requiring Standard Contractual Clauses or adequacy decisions.

Legal requirements in Germany

German law requires additional considerations beyond standard GDPR compliance. The Bundesdatenschutzgesetz (BDSG) provides specific national requirements that may affect your agreement, particularly regarding employee data processing and special categories of personal data. You must consider state-level data protection laws (Landesdatenschutzgesetze) that may apply depending on your operational locations within Germany. The agreement should address reporting obligations to German supervisory authorities, including the Federal Commissioner for Data Protection and Freedom of Information (BfDI) and relevant state authorities. German courts apply strict contractual interpretation under the Bürgerliches Gesetzbuch (BGB), so precise language and clear obligations are essential. Regular review and updates of the agreement are recommended to maintain compliance with evolving German data protection guidance and enforcement practices.