Data Processing Agreement (Auftragsverarbeitungsvertrag, AVV)

A data processing agreement (DPA), known in German as Auftragsverarbeitungsvertrag (AVV), is the contract required under the EU General Data Protection Regulation whenever one organisation processes personal data on behalf of another. The party that decides why and how data is processed is the controller; the party that processes it on instruction is the processor. The agreement sets out the subject, purpose and duration of processing, the obligations of each side, security measures and rules for engaging sub-processors. For ERP and cloud users in the DACH region it is a standard requirement when working with hosting providers, SaaS ERP vendors and other service partners that touch personal data.

Purpose and legal basis

The DPA exists to ensure that personal data remains protected even when its handling is outsourced. Under the GDPR, a controller may only use processors that provide sufficient guarantees of appropriate technical and organisational measures, and the relationship must be governed by a binding contract. The agreement makes the processor's duties enforceable and documents the chain of accountability, which supports the controller's broader obligations around data protection in ERP. Without such an agreement, transferring personal data to a service provider would lack a proper legal foundation.

Typical contents

While wording varies, a DPA generally addresses a consistent set of points:

• The nature, purpose and duration of the processing and the categories of data and data subjects.
• The instruction relationship, confirming the processor acts only on the controller's documented instructions.
• Technical and organisational security measures protecting the data.
• Rules for engaging sub-processors, including notice and equivalent obligations.
• Support for data-subject rights, breach notification and deletion or return of data at the end of the contract.
• Provisions for audits and demonstrating compliance.

Security commitments are frequently evidenced through certifications or attestations such as SOC 2, which give the controller assurance about the processor's controls.

Controller and processor roles

The distinction between controller and processor determines who carries which responsibility. The controller defines the purposes and decides what may be done with the data; the processor follows those instructions and may not use the data for its own purposes. In ERP scenarios, the operating business is usually the controller, while a hosting partner, cloud platform or specialist service that processes employee, customer or supplier data acts as processor. Where several parties jointly decide on purposes, joint-controller arrangements may apply instead, which require their own form of agreement.

Practical relevance for ERP and cloud

Because modern ERP increasingly runs as a hosted or cloud service, a DPA is almost always needed before personal data is entrusted to a provider. It connects to wider compliance topics including security obligations under frameworks such as NIS-2 and the documentation expectations associated with GoBD. A DPA is not the same as the controller's own privacy notice to individuals, nor a substitute for technical security measures; it is the contractual layer that defines responsibilities. Organisations should have qualified legal advice review their agreements and reflect their own corporate details, for example as set out in the imprint, rather than relying on generic templates alone.

Related Topics

• GDPR in ERP
• SaaS ERP
• SOC 2