Data Processing Agreement in Germany: Template, Key Clauses and Local Law (2026)

What a data processing agreement in Germany is A data processing agreement (DPA) in Germany, known as an Auftragsverarbeitungsvertrag (AVV), is the contract a controller must put in place when it uses another organisation to process personal data on its behalf. If a business engages a cloud host, payroll provider, analytics tool or any vendor that handles personal data for its purposes, that vendor is a processor, and the GDPR requires a written data processing agreement between them. In Germany the framework is the EU General Data Protection Regulation (GDPR), whose Article 28 sets the mandatory content of the agreement, supplemented by the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the guidance of the German data protection authorities (the federal and state DPAs). Unlike Singapore's lighter regime, the European model is prescriptive: Article 28 lists terms the agreement must contain, and a missing DPA is itself a compliance failure. This article is general guidance, not legal advice. Have a German-qualified lawyer or data protection adviser review a DPA before you rely on it. ## What German law requires in 2026 - A DPA is mandatory. Article 28(3) GDPR requires a binding written contract (which may be electronic) whenever a processor handles personal data for a controller. Processing without one breaches the GDPR.

• Article 28(3) sets the minimum content. The agreement must cover the subject matter, duration, nature and purpose of processing, the type of personal data and categories of data subjects, and the controller's documented instructions. It must bind the processor to confidentiality, security (Article 32), conditions for sub-processors, assistance with data-subject rights, assistance with breach and impact-assessment duties, and deletion or return of data at the end.
• Sub-processors. A processor may engage a sub-processor only with the controller's authorisation and must flow down the same obligations (Article 28(2) and (4)).
• Security. Article 32 GDPR requires appropriate technical and organisational measures, usually detailed in a security schedule (TOMs, technische und organisatorische Massnahmen).
• Breach notification. The processor must notify the controller without undue delay of a personal data breach so the controller can meet its 72-hour reporting duty under Article 33.
• International transfers. Transfers outside the EU and EEA need a valid mechanism, such as standard contractual clauses and, where needed, supplementary measures.
• BDSG supplements the GDPR. German law adds rules, for example on employee data and on the DPAs' powers. ## Key clauses in a German DPA | Clause | Why it matters under the GDPR and BDSG | | --- | --- | | Subject matter and scope | Article 28(3) requires the nature, purpose, duration, data types and data-subject categories. | | Documented instructions | Processor acts only on the controller's documented instructions. | | Confidentiality | Persons processing the data are bound to confidentiality. | | Security (Article 32) | Technical and organisational measures, usually in a TOM schedule. | | Sub-processors | Authorisation and flow-down of the same obligations. | | Data-subject rights | Processor assists the controller with access, erasure and other requests. | | Breach notification | Prompt notice to the controller to meet the 72-hour duty. | | Assistance with duties | Support for impact assessments and DPA consultations. | | International transfers | Valid transfer mechanism for data leaving the EU and EEA. | | Deletion or return | What happens to data at the end of the processing. | | Audit and records | The controller's right to verify compliance. | ## A simple DPA structure you can adapt 1. Parties, roles and definitions.

2. Subject matter, nature, purpose and duration of processing.
3. Types of personal data and categories of data subjects.
4. Processing only on documented instructions.
5. Confidentiality undertakings.
6. Security measures (TOM schedule under Article 32).
7. Sub-processors: authorisation and flow-down.
8. Assistance with data-subject rights and controller duties.
9. Breach notification to the controller.
10. International transfers and the mechanism used.
11. Deletion or return of data at the end.
12. Audit rights and records.
13. Governing law (Germany) and liability within the GDPR framework. ## Red flags to avoid - No written DPA at all, which is itself a GDPR breach whenever a processor handles personal data.

• An agreement that omits one of the Article 28(3) mandatory terms, leaving it non-compliant.
• Sub-processors appointed with no controller authorisation and no flow-down of obligations.
• No security schedule, so the Article 32 technical and organisational measures are undefined.
• Transfers outside the EU with no valid mechanism such as standard contractual clauses.
• A breach-notification clause that is vague on timing, risking the controller's 72-hour duty.
• No deletion or return process at the end of the processing. ## Where a contract workspace helps A template gives you a solid German DPA. The ongoing work starts after signing: keeping the sub-processor list current, confirming a valid transfer mechanism is in place before data leaves the EU, checking the security schedule exists and is up to date, and keeping breach-notification duties visible across many vendor DPAs. Drafting the DPA, reviewing each vendor's version against the Article 28 checklist and for transfer and sub-processor gaps, and tracking review dates can sit in one AI workspace tuned to how your company handles data. Adira is built around that shape: it drafts from your template, models the agreement as linked clauses so it can flag a missing Article 28 term or an absent transfer mechanism, lets you edit clauses in plain language, and keeps review and renewal dates on one timeline. Adira is India-first today, and deeper Germany-specific coverage is on its roadmap rather than a settled claim, so use it for drafting and review and keep a German data protection adviser for the local-law call. The template above is enough to put a fair agreement in place on its own. Last verified October 2026.