������Ƶ

The Controller Processor Agreement is a mandatory requirement under both the EU General Data Protection Regulation (GDPR) and German Federal Data Protection Act (BDSG) whenever an organization (controller) engages another party (processor) to process personal data on its behalf. This document must be in place before any data processing begins and serves as the legal framework governing the data processing relationship. It should be used in any scenario where external service providers handle personal data, such as cloud services, HR systems, or marketing platforms. The agreement must comply with Article 28 GDPR requirements while incorporating specific German legal obligations and considering guidance from German supervisory authorities. It establishes clear responsibilities, technical and organizational measures, and procedures for ensuring data protection compliance.

1. Parties: Identification of the data controller and data processor, including full legal names, registration details, and authorized representatives

2. Background: Context of the agreement, relationship between parties, and purpose of data processing activities

3. Definitions: Key terms used in the agreement, including those from GDPR, BDSG, and specific processing activities

4. Scope and Purpose of Processing: Detailed description of the processing activities, categories of data, and processing purposes

5. Duration: Term of the agreement and processing activities

6. Nature and Purpose of Processing: Specific details about how and why the data will be processed

7. Types of Personal Data and Categories of Data Subjects: Comprehensive list of personal data types and categories of individuals whose data will be processed

8. Obligations of the Processor: Core processor obligations under GDPR Article 28 and BDSG, including processing only on documented instructions

9. Obligations of the Controller: Controller's responsibilities, including providing documented instructions and ensuring lawful basis for processing

10. Technical and Organizational Measures: Reference to security measures implemented by the processor

11. Sub-processing: Conditions and requirements for engaging sub-processors

12. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests

13. Data Breach Notification: Procedures and timeframes for notifying controller of personal data breaches

14. Audit Rights: Controller's rights to audit and processor's obligations to contribute to audits

15. Data Return and Deletion: Obligations regarding data handling upon termination of services

16. Liability and Indemnification: Allocation of liability between parties and indemnification obligations

17. Governing Law and Jurisdiction: Specification of German law as governing law and jurisdiction for disputes