The Personal Data Transfer Agreement is essential for organizations transferring personal data under German jurisdiction, whether within Germany, the EU, or internationally. This document is required when personal data is shared between different legal entities, including between controllers and processors, joint controllers, or intra-group transfers. It ensures compliance with the German Federal Data Protection Act (BDSG) and the EU General Data Protection Regulation (GDPR), incorporating mandatory provisions for data protection, security measures, and data subject rights. The agreement is particularly crucial given Germany's strict data protection requirements and the potential for significant penalties for non-compliance. It should be implemented before any personal data transfer begins and must be regularly reviewed to ensure continued compliance with evolving data protection laws.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Your data doesn't train Genie's AI
You keep IP ownership聽of your docs
Alternatively...
1. Parties: Identification of the data exporter and data importer, including their full legal names, registration details, and authorized representatives
2. Background: Context of the data transfer relationship, purpose of the agreement, and brief description of data processing activities
3. Definitions: Key terms used in the agreement, aligned with GDPR Article 4 definitions and any additional terms specific to the transfer arrangement
4. Subject Matter and Duration: Scope of data transfer, types of personal data, categories of data subjects, and duration of processing activities
5. Nature and Purpose of Processing: Detailed description of how the personal data will be processed and the specific purposes for which it will be used
6. Obligations of the Parties: Core responsibilities of both parties, including compliance with GDPR principles, maintaining records, and ensuring data security
7. Technical and Organizational Measures: Required security measures to ensure appropriate level of data protection, including encryption, access controls, and backup procedures
8. Sub-processing: Conditions and requirements for engaging sub-processors, including notification and approval processes
9. Data Subject Rights: Procedures for handling data subject requests and ensuring data subjects can exercise their GDPR rights
10. Data Breach Notification: Procedures and timeframes for reporting and handling personal data breaches
11. Audit Rights: Rights and procedures for conducting audits to verify compliance with the agreement
12. Term and Termination: Duration of the agreement, renewal terms, and conditions for termination
13. Return or Deletion of Data: Obligations regarding the return or deletion of personal data upon termination of services
14. Governing Law and Jurisdiction: Specification of German law as governing law and jurisdiction for dispute resolution
1. International Transfer Mechanisms: Required when transfers are to countries outside the EEA, incorporating appropriate safeguards such as Standard Contractual Clauses
2. Special Categories of Data: Additional provisions required when processing special categories of personal data under Article 9 GDPR
3. Works Council Provisions: Required when the transfer involves employee data subject to works council co-determination rights
4. Data Protection Impact Assessment: Reference to and incorporation of DPIA findings when high-risk processing is involved
5. Joint Controller Arrangements: Required when the relationship between parties qualifies as joint controllership under Article 26 GDPR
6. Liability and Indemnification: Detailed provisions on liability allocation and indemnification obligations
7. Insurance Requirements: Specific insurance obligations for data protection-related incidents
1. Description of Transfer: Detailed description of the transfer including categories of data subjects, types of personal data, special categories of data if any, and processing operations
2. Technical and Organizational Measures: Detailed specification of security measures implemented by both parties
3. List of Approved Sub-processors: If applicable, list of pre-approved sub-processors and their processing activities
4. Transfer Impact Assessment: Assessment of the data protection legal framework in the recipient country (for international transfers)
5. Standard Contractual Clauses: If applicable, the complete set of SCCs as approved by the European Commission
6. Data Processing Details: Specific details about processing activities, including processing purposes, duration, and nature
7. Contact Details: List of key contacts for both parties, including Data Protection Officers and designated representatives
Authors
Find the document you need
Data Processing Contract
A German law-governed agreement establishing terms for GDPR-compliant personal data processing between controller and processor.
Download
Controller To Controller Agreement
A German law-governed agreement establishing joint processing arrangements between two or more data controllers under GDPR and BDSG requirements.
Download
Joint Controller Agreement
A German law-governed agreement establishing shared data protection responsibilities between joint controllers under GDPR Article 26 and BDSG requirements.
Download
Standard Data Processing Agreement
A German law-governed Data Processing Agreement ensuring GDPR compliance for personal data processing between controller and processor.
Download
Data Processing Addendum
A German law-compliant Data Processing Addendum that establishes terms for personal data processing under GDPR and BDSG requirements.
Download
Intra Group Data Transfer Agreement
German law-governed agreement regulating personal data transfers between group companies, ensuring GDPR and BDSG compliance.
Download
Intercompany Data Processing Agreement
German law-governed data processing agreement between group companies, compliant with GDPR and BDSG requirements.
Download
Data Transfer Addendum
German law-governed Data Transfer Addendum ensuring GDPR compliance and German BDSG requirements for secure personal data transfers between organizations.
Download
Personal Data Transfer Agreement
A German law-governed agreement for compliant transfer of personal data between parties, ensuring GDPR and BDSG compliance.
Download
骋别苍颈别鈥檚 Security Promise
Genie is the safest place to draft. Here鈥檚 how we prioritise your privacy and security.
Your data is private:
We do not train on your data; 骋别苍颈别鈥檚 AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it
