Controller Processor Contract Template for Germany

The Controller Processor Contract is a crucial legal document required whenever an organization (the controller) engages another party (the processor) to process personal data on its behalf within the German jurisdiction. This requirement stems from Article 28 of the GDPR and is further regulated by the German Federal Data Protection Act (BDSG). The agreement must be in place before any data processing begins and serves to ensure both parties understand and comply with their respective obligations under data protection law. It covers essential aspects such as the scope of processing, security measures, confidentiality requirements, subprocessing conditions, and procedures for data breaches. The document is particularly important in the German context due to strict regulatory oversight and specific national requirements that supplement the GDPR.

1. Parties: Identification of the data controller and data processor with full legal entity details

2. Background: Context of the processing relationship and purpose of the agreement

3. Definitions: Key terms used in the agreement, including GDPR-specific terminology

4. Scope and Purpose of Processing: Detailed description of the processing activities, categories of data, and processing purposes as required by Art. 28 GDPR

5. Duration: Term of the agreement and processing activities

6. Obligations of the Processor: Core processor obligations under Art. 28 GDPR, including processing only on documented instructions

7. Confidentiality: Confidentiality obligations for processor personnel and subcontractors

8. Technical and Organizational Measures: Overview of security measures with reference to detailed schedule

9. Subprocessing: Conditions and requirements for engaging subprocessors

10. Data Subject Rights: Processor's obligations to assist controller with data subject requests

11. Personal Data Breach: Notification requirements and procedures for data breaches

12. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance

13. Data Return and Deletion: Obligations regarding data handling upon agreement termination

14. Liability and Indemnification: Allocation of liability and indemnification obligations

15. Governing Law and Jurisdiction: Specification of German law and jurisdiction