Data Privacy Addendum Template for Germany

The Data Privacy Addendum is a crucial legal document required whenever a company (data controller) engages another party (data processor) to process personal data on its behalf under German jurisdiction. It serves as a mandatory supplement to the main service agreement, ensuring compliance with Article 28 of the GDPR and the German Federal Data Protection Act (BDSG). This document becomes necessary when implementing new vendor relationships involving data processing, updating existing agreements to meet GDPR requirements, or establishing joint controller arrangements. It details specific obligations regarding data security, breach notification, sub-processing, and data subject rights, while incorporating Germany's stringent data protection standards and specific requirements for technical and organizational measures.

1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses

2. Background: Context of the existing relationship between parties and purpose of this DPA

3. Definitions: Key terms used in the agreement, aligned with GDPR Article 4 definitions and German law terminology

4. Scope and Purpose: Detailed description of the data processing activities covered by the DPA

5. Roles and Responsibilities: Clear designation of parties as controller, processor, or joint controllers and their respective obligations

6. Processing Instructions: Specific instructions for data processing, including permitted purposes and processing boundaries

7. Technical and Organizational Measures: Security measures required under GDPR Article 32 and German law

8. Confidentiality: Confidentiality obligations for personnel and data processing activities

9. Subprocessing: Rules and procedures for engaging subprocessors

10. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

11. Data Breach Notification: Procedures and timelines for breach notification as per GDPR and German law requirements

12. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

13. Data Return and Deletion: Obligations regarding data handling upon agreement termination

14. Liability and Indemnification: Allocation of liability and indemnification obligations

15. Term and Termination: Duration of the DPA and termination provisions