1. Parties: Identification of the data controller (client) and data processor (service provider), including full legal names, registration details, and addresses
2. Background: Context of the agreement, relationship between parties, and brief description of processing activities
3. Definitions: Definitions of key terms used in the agreement, aligned with FADP terminology
4. Scope and Purpose of Processing: Detailed description of the authorized data processing activities, categories of data, and processing purposes
5. Duration of Processing: Term of the agreement and processing activities, including conditions for termination
6. Obligations of the Data Processor: Core responsibilities including processing only on documented instructions, confidentiality, security measures, and subprocessor management
7. Rights and Obligations of the Data Controller: Controller's responsibilities, including providing instructions and ensuring lawful basis for processing
8. Security Measures: Technical and organizational measures required to ensure appropriate security of personal data
9. Personal Data Breach Notification: Procedures and timeframes for reporting data breaches to the controller
10. Audit Rights: Controller's rights to audit processor's compliance and processor's obligations to assist
11. Data Subject Rights: Processor's obligations to assist controller in responding to data subject requests
12. Return or Deletion of Data: Obligations regarding data handling upon termination of services
13. Liability and Indemnification: Allocation of liability and indemnification obligations between parties
14. Governing Law and Jurisdiction: Specification of Swiss law as governing law and jurisdiction for disputes
