DPA (data processing agreement, German AVV)
Contract under Art. 28 GDPR between controller and processor — mandatory for any processing carried out on behalf of another.
Anyone processing personal data on behalf of another party (hosting, newsletters, cloud, payroll) needs a data processing agreement (Art. 28 GDPR). Mandatory content: subject matter, duration, purpose, data categories, processing only on documented instructions, technical and organisational measures, sub-processors, audit rights, deletion after the contract ends.
¹Note: This definition is for general orientation only and does not replace legal advice for your case.
Ready to clarify your matter?
{n} credits free. No credit card required. Ready in 2 minutes.
Start free now
No credit card required · GDPR-compliant · Start for free