Data Processing Agreement in Austria: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the written contract that must exist whenever one organisation (the controller, which decides why and how personal data is processed) uses another (the processor, which processes that data on the controller's instructions). It is not an optional add-on. Where a processor handles personal data for a controller, EU law requires a contract with a defined set of terms, and a missing or inadequate DPA is itself a breach that can be fined. In Austria the rules come from the EU General Data Protection Regulation (GDPR), which applies directly, and from the national Datenschutzgesetz (DSG), overseen by the data protection authority, the Datenschutzbehoerde (DSB). This guide sets out the law that actually bites, the clauses an Austria DPA must contain under Article 28 GDPR, and a section-by-section skeleton you can adapt. It is general information, not legal advice; confirm the detail with qualified Austrian counsel before you sign. ## Austria: the local law that shapes your DPA The controlling instrument is Article 28 of the GDPR. It states that processing by a processor must be governed by a contract that is binding on the processor, sets out the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subject, and the obligations and rights of the controller. It then lists the specific terms the contract must contain, which are set out below. Because the GDPR is a Regulation, these requirements apply in Austria in the same words as across the EU. Austria's Datenschutzgesetz (DSG) implements and supplements the GDPR nationally. It confirms the Datenschutzbehoerde (DSB) as the single supervisory authority, with powers of investigation, audit and access, and it addresses matters the GDPR leaves to member states, such as some processing in the employment context and data of deceased persons. For the content of a DPA, Article 28 is the master text; the DSG and the DSB's guidance sit around it. ### International transfers If the processor or a subprocessor is outside the European Economic Area, the DPA must also address a lawful transfer mechanism, most often the European Commission's Standard Contractual Clauses, plus any supplementary measures the transfer needs. Build this into the DPA rather than leaving it to a side letter. ## The clauses an Austria DPA must contain Article 28(3) GDPR sets a mandatory checklist. A compliant DPA must require the processor to: - Process only on documented instructions from the controller, including on international transfers, unless required to act by law.

• Ensure confidentiality, so that people authorised to process the data are bound to keep it confidential.
• Apply appropriate security measures under Article 32 (the security of processing).
• Respect the rules on subprocessors, engaging another processor only with the controller's authorisation and passing the same obligations down the chain by contract.
• Assist the controller in responding to data subject requests (access, erasure, portability and the rest).
• Assist with compliance on security, breach notification, data protection impact assessments and prior consultation.
• Delete or return all personal data at the end of the services, and delete existing copies unless storage is legally required.
• Make available the information needed to show compliance, and allow and contribute to audits and inspections by the controller or an appointed auditor. Around that core, a workable DPA also sets out the detail Article 28(3) opens with: the subject matter and duration, the nature and purpose, the types of data and categories of data subject, breach notification timing, the transfer mechanism, and the list of approved subprocessors. ## A data processing agreement skeleton you can adapt Use this running order as a drafting checklist. It is a skeleton, not a finished contract, and it is not legal advice. 1. Parties, and their roles as controller and processor

2. Definitions (aligned to the GDPR)
3. Subject matter, duration, nature and purpose of processing
4. Types of personal data and categories of data subject (often an annex)
5. Processing only on documented instructions
6. Confidentiality of authorised persons
7. Security measures (Article 32), often a technical and organisational measures annex
8. Subprocessors: authorisation, flow-down and liability
9. Assistance with data subject rights
10. Assistance with security, breach notification, impact assessments
11. Personal data breach notification timing and content
12. International transfers and the transfer mechanism
13. Deletion or return of data on termination
14. Audits, inspections and records
15. Liability, and interaction with the main agreement
16. Governing law (Austrian) and the relationship to the underlying contract ## Common mistakes to avoid - Treating the DPA as boilerplate. Article 28 is a mandatory checklist. Dropping one of the required terms leaves the contract non-compliant even if every commercial point is covered.

• Vague instructions. The processor must act only on documented instructions. If the DPA does not describe the processing precisely, that limit is meaningless.
• Ignoring subprocessors. Every subprocessor must be authorised and bound by the same terms. An unflowed-down chain is a common audit failure.
• Forgetting transfers. If data leaves the EEA, name the mechanism. Standard Contractual Clauses do not apply themselves.
• No deletion plan. The DPA must say what happens to the data at the end. Keeping it indefinitely with no basis is a breach. ## Keeping the agreement alive after signing The work does not stop at signature. A DPA carries a living subprocessor list, breach-notification clocks, audit rights, transfer mechanisms that change when the law changes, and a deletion obligation at the end of each underlying contract. Most problems come not from a badly drafted clause but from a subprocessor added without notice, a breach clock missed, or a deletion step nobody tracked. That is the case for keeping drafting, review, version history and obligation tracking in one place rather than spread across inboxes, a shared drive and a spreadsheet. Adira is one such AI workspace: you draft from your own templates, see each clause flagged as favourable, neutral or unfavourable to you, edit clauses in plain English, and keep a live timeline of every subprocessor change, audit and obligation, built on Anthropic's Claude. Adira is India-first today; deeper support for Austrian and EU data protection law is on its roadmap rather than live, so treat it as a workflow layer here and keep local counsel for the legal substance.