Contract Review & Drafting

Contract Review & Drafting: existing ones reviewed, new ones drafted with legal certainty.

DPAs reviewed or drafted to fit, whichever you need.

What we deliver

From obligation to advantage.

We review existing data processing agreements, joint controllership arrangements and non-disclosure agreements, or draft them to fit your real-world data flows instead of template compliance.

  • Content review of existing DPAs under Art. 28 GDPR
  • Tailored contract drafting instead of template compliance
  • Joint Controllership Agreements (JCA) and non-disclosure agreements (NDA)
  • Technical and organisational measures and sub-processor lists
  • Billed in quarter-hour units

How we work

Three steps to your goal.

  1. Step 01

    Scoping

    You tell us whether an existing contract should be reviewed, or a new DPA, JCA or NDA should be drafted based on your real data flows.

  2. Step 02

    Review or draft

    Review of the clauses under Art. 28 GDPR or Art. 26 GDPR. For drafting: an individual contract including technical and organisational measures and a sub-processor list.

  3. Step 03

    Negotiation & signing

    On request we support the negotiation with your contract partner through to signature. Billed in quarter-hour units.

DPAs & data contracts

Contracts that mirror the real data flow.

As soon as a provider processes personal data on your behalf, a data processing agreement (DPA) under Art. 28 GDPR is mandatory, whether cloud storage, a newsletter tool, payroll or IT maintenance. If it is missing or incomplete, you are liable as the controller.

Mandatory contents under Art. 28(3) GDPR

  • Subject matter, duration, nature and purpose of the processing
  • Binding to instructions and confidentiality
  • Technical and organisational measures (Art. 32 GDPR)
  • Rules on sub-processors (further processors)
  • Support with data subject rights and breach notifications
  • Deletion or return of the data plus evidence and audit rights

DPA, joint controllership or NDA?

Not every collaboration is processing on behalf. Where both parties jointly decide on purposes and means, it is joint controllership (Art. 26 GDPR) with its own type of contract.

Common mistakes we fix

  • Outdated DPAs still referencing the old EU Data Protection Directive
  • Missing or generic technical and organisational measures
  • Unreviewed sub-processors and third-country transfers
  • No DPA at all despite clear processing on behalf

More services

What else we cover.

From the blog

Further reading on the topic.

Need advice on data protection?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What keeps coming up with contracts.

How long does reviewing a DPA take?
A typical standard DPA is reviewed in 30 to 90 minutes. For complex JCAs, EU SCCs with third-country transfer or group contracts, expect 2 to 4 hours.
Why not just use a template contract?
Template DPAs are often dismissed in GDPR review practice as "blank DPAs" if they do not reflect the actual processing reality. Data-intensive processing requires individualised measures and rights to issue instructions.
Do you also provide Joint Controllership Agreements?
Yes. JCAs under Art. 26 GDPR are a focus, particularly for marketing cooperations, shared platforms or research projects.
Do you review and draft English-language contracts too?
Yes. We review and draft GDPR DPAs as well as EU Standard Contractual Clauses (SCCs) in English, including international DPAs and sub-processor arrangements.
What fines and penalties are possible?
Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine.