1. Parties: Identification of the data exporter and data importer, including their full legal names, registration details, and authorized representatives
2. Background: Context of the data transfer relationship, purpose of the agreement, and brief description of data processing activities
3. Definitions: Key terms used in the agreement, aligned with GDPR Article 4 definitions and any additional terms specific to the transfer arrangement
4. Subject Matter and Duration: Scope of data transfer, types of personal data, categories of data subjects, and duration of processing activities
5. Nature and Purpose of Processing: Detailed description of how the personal data will be processed and the specific purposes for which it will be used
6. Obligations of the Parties: Core responsibilities of both parties, including compliance with GDPR principles, maintaining records, and ensuring data security
7. Technical and Organizational Measures: Required security measures to ensure appropriate level of data protection, including encryption, access controls, and backup procedures
8. Sub-processing: Conditions and requirements for engaging sub-processors, including notification and approval processes
9. Data Subject Rights: Procedures for handling data subject requests and ensuring data subjects can exercise their GDPR rights
10. Data Breach Notification: Procedures and timeframes for reporting and handling personal data breaches
11. Audit Rights: Rights and procedures for conducting audits to verify compliance with the agreement
12. Term and Termination: Duration of the agreement, renewal terms, and conditions for termination
13. Return or Deletion of Data: Obligations regarding the return or deletion of personal data upon termination of services
14. Governing Law and Jurisdiction: Specification of German law as governing law and jurisdiction for dispute resolution
