1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses
2. Background: Context of the agreement, reference to the main service agreement, and purpose of the DPA
3. Definitions: Key terms used in the agreement, including those from GDPR and German law (BDSG)
4. Scope and Purpose of Processing: Detailed description of the data processing activities, categories of data subjects and personal data
5. Duration: Term of the DPA, typically linked to the main agreement's duration
6. Obligations of the Processor: Core processor obligations under GDPR Art. 28 and BDSG, including processing only on documented instructions
7. Obligations of the Controller: Controller's responsibilities, including providing documented instructions and ensuring legal basis for processing
8. Technical and Organizational Measures: Security measures implemented to ensure appropriate level of data protection
9. Sub-processing: Conditions and requirements for engaging sub-processors
10. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests
11. Data Protection Impact Assessment: Cooperation requirements for DPIAs and prior consultations
12. Data Breach Notification: Procedures and timeframes for reporting personal data breaches
13. Audit Rights: Controller's audit rights and processor's obligations to demonstrate compliance
14. Data Return and Deletion: Obligations regarding data handling upon agreement termination
15. Liability and Indemnification: Allocation of responsibility and liability between parties
