Data processing agreement under Art. 28 GDPR (Germany)
Published byDocMuse
This document is in German
The PDF you download is in German — that is the language it has to be filed in, so it is not translated. Everything on this page is here to tell you what it says.
The data processing agreement (Auftragsverarbeitungsvertrag, AVV) every business in Germany needs when a service provider processes personal data for it — hosting, cloud software, payroll, newsletters, IT support. It contains everything Art. 28(3) GDPR requires: subject-matter, duration, nature and purpose, types of data and data subjects, instructions, confidentiality, security, sub-processors, assistance, deletion or return, information and audits, with annexes for the technical and organisational measures and the sub-processors. Free models from supervisory authorities and the European Commission also exist. In German.
What you fill in
The details the document asks for.
- Data controller
- Controller's address
- Signing for the controller
- Processor (service provider)
- Processor's address
- Signing for the processor
- Processor's data protection officer (if appointed)
- Main contract (title and date)
- Subject-matter, nature and purpose of the processing
- Categories of personal data
- Categories of data subjects
- Authorisation of sub-processors
- Objection period under a general authorisation of sub-processors
- Where the data are processed
- Measures: pseudonymisation and encryption
- Measures: confidentiality and integrity
- Measures: availability, resilience and recovery
- Measures: regular testing and evaluation
- Approved sub-processors (name, address, service, location) or “none”
- City
- Date
Preview
This document is produced for you. Your answers are typed into it and the finished PDF is yours to keep.
Common questions
- Are there free model data processing agreements in Germany?
- Yes. Several German Land data protection authorities publish drafting aids, the Bavarian authority (BayLDA) among them, and the European Commission adopted standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915). This document is our own wording: it contains everything Art. 28(3) GDPR requires and can be filled in directly.
- Must a German data processing agreement be signed on paper?
- No. Art. 28(9) GDPR requires the contract to be in writing, which includes electronic form. A contract exchanged as a PDF or concluded online is therefore enough; neither a handwritten signature nor a qualified electronic signature is required. What matters is that the contract is documented and in place before the processing begins.
- When does a business in Germany not need a data processing agreement?
- When the service provider does not process on your instructions but decides on the purposes and means itself — a law firm, a bank or a postal service in providing its own service, for example. It is then a controller in its own right. A provider that only stores or handles data as you direct, such as a host, a cloud provider or a newsletter service, is a processor (Art. 4(8) and Art. 28 GDPR).
- What must a processor in Germany do after a data breach?
- Notify the controller of every personal data breach without undue delay after becoming aware of it (Art. 33(2) GDPR), with the details the controller needs. The controller must in turn notify the competent supervisory authority, where feasible within 72 hours, unless the breach is unlikely to result in a risk (Art. 33(1) GDPR) — for a German business, usually its Land's data protection authority.
How you can sign this document
- Print it and sign by hand. The signature lines in the document are left blank on purpose — sign on them in ink.
- Sign it yourself with a qualified electronic signature. If you already hold a QES — Evrotrust, B-Trust, StampIT, ZealiD or any qualified provider on the EU Trusted List, on a card, a USB token, in a mobile app or in the cloud — our signing guide explains step by step how to sign this exact file without invalidating it. Step-by-step help, and a way to check it worked
DocMuse sells documents, not legal advice. Acceptance always depends on the recipient's rules and your local law.
Related documents
- Data subject access request under Article 15 GDPR (Germany)
Your request to a company, club or other body in Germany that processes data about you: under Article 15 of the GDPR (DSGVO in German) you ask what data it holds, why, who receives it, how long it keeps it and where it came from, and for a copy of the data — the first copy free. The answer is due within one month (Article 12(3)). If none comes, you can complain to the data protection authority of your German state. For customer, member and user accounts. In German.
- Objection to data transfers from the population register (Germany)
The informal letter to the German registration office (Meldebehörde) that has transfer blocks entered in the population register: you object, point by point, to your data being passed to political parties before elections, to office-holders and the press for birthday and wedding anniversaries, to address-book publishers (§ 50(5) of the Federal Registration Act, BMG) and to a family member's religious community (§ 42(3) BMG). It leaves out the objection to transfers to the Bundeswehr, abolished on 1 January 2026. Many offices also offer their own free form. In German.