Review key requirements for a data processing agreement
Mag. Bernhard Brandauer, Rechtsanwalt
BRANDAUER Rechtsanwälte
Mag. Bernhard Brandauer advises businesses on the legal classification and practical implementation of data protection requirements.
A processor agreement must do more than name the parties. It should describe the subject matter, documented instructions, confidentiality, security measures, sub-processors, assistance and what happens to the data when the engagement ends.
Answer the questions using the agreement and its annexes. The result is an initial structural orientation. It does not replace a review of the specific agreement, its annexes and the actual processing.
Mag. Bernhard Brandauer, Rechtsanwalt
Interactive structure check for processor agreements used in Austria. The check indicates whether key contractual areas appear to be covered.
Also check the types of data and categories of data subjects.
Your answers indicate that the main contractual areas are addressed in the agreement or its annexes. Still check whether the actual processing, security measures and sub-processor list match the contract.
Your answers indicate that the main contractual areas are addressed in the agreement or its annexes. Still check whether the actual processing, security measures and sub-processor list match the contract.
Your answers indicate that the main contractual areas are addressed in the agreement or its annexes. Still check whether the actual processing, security measures and sub-processor list match the contract.
Your answers indicate that the main contractual areas are addressed in the agreement or its annexes. Still check whether the actual processing, security measures and sub-processor list match the contract.
Several answers indicate incomplete or general provisions. Pay particular attention to instructions, security measures, sub-processors and audit rights.
Several answers indicate incomplete or general provisions. Pay particular attention to instructions, security measures, sub-processors and audit rights.
Several answers indicate incomplete or general provisions. Pay particular attention to instructions, security measures, sub-processors and audit rights.
Several answers indicate incomplete or general provisions. Pay particular attention to instructions, security measures, sub-processors and audit rights.
Several answers indicate incomplete or general provisions. Pay particular attention to instructions, security measures, sub-processors and audit rights.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Your answers indicate several important open areas. Without reviewing the specific agreement, it is not possible to assess whether the actual processing is sufficiently covered by Article 28 GDPR.
Use the result as a working list. For a specific draft, review the service description, instruction process, annexes, international transfers and the actual cooperation together.
No. The roles depend on whether a provider processes personal data on behalf of and under documented instructions from the controller. The actual processing matters, not only the contract heading.
The agreement must address the requirements for security of processing. Concrete measures are often set out in an annex. That annex should match current processing and record changes clearly.
It asks about authorisation, information, procedures and a current list. You should also compare the actual provider chain with the contractual information.
The agreement should address return or deletion, backup copies and evidence. Legal retention duties may require a separate assessment.
No. The result only indicates structural review needs based on your answers. Approval requires reviewing the specific agreement, its annexes and the actual processing.
Receive new articles and legal information from the firm with BRANDaktuelle Rechtsnews.
Subscribe to legal updates →Background on roles, duties and practical organisation.
Documents and review points for a structured comparison.
This check provides initial orientation and does not replace a review of the specific agreement and processing operations.
Tell us briefly what is happening. We will help classify the situation and discuss which documents and next step are useful for your business.
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg Österreich
Phone
+43 662 6280000