Auftragsverarbeitungsvertrag (AVV)

As soon as a service provider collects retired laptops, erases hard drives or destroys data carriers, it has access to personal data of your company. In such cases the GDPR requires a written contract with fixed minimum content: the data processing agreement. This glossary entry explains what it must contain, when it is needed in IT retirement and which mistakes commonly occur in practice.

What is a data processing agreement?

The GDPR distinguishes two roles. The controller decides on the purposes and means of data processing, as a rule your company. The processor processes data only on its behalf and on its instructions, for example a data center, a payroll bureau or a data erasure service provider.

The data processing agreement, often abbreviated as DPA or AVV, is the legal basis of this cooperation. It must be concluded in writing, whereby an electronic format is sufficient (Art. 28(9) GDPR). The EU Commission has additionally published standard contractual clauses for processing, which companies can use but do not have to.

Important: the DPA does not shift responsibility. You remain responsible for the data and must select the service provider carefully. Under Art. 28(1) GDPR you may only work with processors that, through appropriate Technical and organizational measures (TOMs) offer sufficient guarantees.

What does Art. 28 GDPR say? The mandatory content

Art. 28(3) GDPR names what a DPA must regulate at a minimum. In addition to the subject matter, duration, nature and purpose of the processing, the type of data and the categories of data subjects, these are the following obligations of the processor:

Obligation (Art. 28(3))	Contents	Relevance when retiring IT
point (a) – Binding to instructions	Processing only on documented instructions	You determine which erasure or destruction method applies
point (b) – Confidentiality	Employees are bound to confidentiality	Commitment of the personnel who transport and handle devices
point (c) – Security	Measures under Art. 32 GDPR	Secure transport, access control, protected storage
point (d) – Sub-processors	Only under the conditions of paragraphs 2 and 4	Whether transport or destruction is subcontracted to third parties
point (e) – Data subject rights	Support with requests from data subjects	Information on whether and when a data carrier was erased
point (f) – Assistance	Help with obligations under Art. 32 to 36 GDPR	Notification if a device is lost (data breach)
point (g) – Erasure or return	Erase or return all data after completion	Core of the service: erasure or destruction per data carrier
point (h) – Evidence and audits	Provide information, enable audits	Erasure and destruction certificates, audit reports, on-site inspections

A DPA that merely refers to the law is not enough. The obligations should be tailored to the specific service, that is, describe for example how devices are packed, transported, erased and documented.

When is IT retirement a data processing?

Supervisory authorities generally classify the erasure or destruction of data carriers by an external service provider as data processing on behalf of a controller. The service provider has access to data carriers with personal data and acts on your behalf. This also applies if it is not supposed to look at the data at all but merely destroys it.

If devices are sold and pass into the buyer’s ownership, the situation is more complex. As long as data still resides on the devices, protecting that data until erasure remains your task. Many companies therefore also conclude a DPA for buyback with erasure or regulate the erasure contractually in an equivalent way. Which arrangement fits in the individual case, clarify with your data protection officer. This entry does not replace legal advice.

How to hand over data carriers in a legally compliant way overall is shown in our guide Disposing of data carriers in GDPR-compliant fashion.

Typical mistakes with the DPA

• No contract before the first pickup date: Devices leave the building before a DPA has been signed.
• Template with no reference to the service: The contract names neither types of data carriers nor erasure methods or the security level of destruction.
• Sub-processors unknown: It remains unclear whether a freight forwarder or a destruction company is involved. More on this under Sub-processor.
• TOM as an empty annex: The annex on Art. 32 GDPR is worded in general terms and describes no transport and access protection measures.
• No documentation rule: There is no agreement that an erasure or destruction certificate is delivered for each serial number.
• No oversight: The contract permits audits, but nobody uses the right or looks at certificates.

Practical example: retiring 300 desktop computers

A simplified example shows how the DPA works in the process. A company replaces 300 desktop computers and commissions a service provider with pickup, erasure and recovery.

1. IT creates a Inventory list with serial numbers. Data protection reviews the service provider’s TOM and concludes the DPA.
2. The DPA specifies: sealed transport, erasure of each data carrier with a certificate per serial number, destruction of data carriers that cannot be erased, information on the sub-processors used.
3. At pickup, a handover protocol is signed. From here on, the documented Chain of custody.
4. After completion, the service provider delivers the documentation. IT reconciles it with the inventory list and files it for documentation.

This way, in an audit the company can show that it has fulfilled its Accountability obligation.

What Second IT relies on for data protection and documentation

Second IT provides the measures that are typically described in a DPA and its TOM annex. Pickup takes place with its own secure logistics: direct runs without interim storage, GPS monitoring, tamper-proof sealing and insured transport. At goods receipt, all devices are checked for storage media and registered by serial number. The processing areas are protected by access control and video surveillance. Employees are bound to data secrecy; NDAs are possible.

Erasure is carried out with Blancco, with a digitally signed erasure certificate for each device. Data carriers that cannot be erased are destroyed in-house according to DIN 66399, certified for security level H-5. Audit reports are available in the customer portal. Second IT is certified to ISO/IEC 27001. More on Data security at Second IT.

Distinction from related terms

the TOM describe the concrete protective measures and are usually an annex to the DPA. An Non-disclosure agreement (NDA) protects business secrets in general, but does not meet the mandatory content of Art. 28 GDPR. In the case of joint controllership under Art. 26 GDPR, two controllers jointly determine purposes and means. This is normally not the case with an erasure or destruction service provider.

Caution, risk of confusion: in environmental law the abbreviation "AVV" also stands for the Waste Catalogue Ordinance (Abfallverzeichnis-Verordnung), from which the Waste code originate. It has nothing to do with data protection. What to look for overall when choosing a service provider, you can read in Choosing an ITAD provider.

Frequently asked questions about the data processing agreement

Do I need a DPA if a service provider only destroys hard drives?

As a rule, yes. Even someone who only destroys data carriers has access to personal data and acts on your behalf. Supervisory authorities therefore mostly classify external data carrier destruction as data processing on behalf of a controller. If in doubt, coordinate the classification with your data protection officer.

Must a DPA be signed on paper?

No. Art. 28(9) GDPR requires written form but expressly permits an electronic format. What matters is that the contract is documented and concluded before processing begins.

What happens if there is no DPA?

Then an obligation under Art. 28 GDPR is missing. Violations of this obligation can be punished with a fine under Art. 83(4) GDPR. In addition, in an emergency you lack the contractual basis to demand documentation and measures from the service provider.

May the service provider involve other companies?

Only with your prior written authorization, either in the individual case or in general. With a general authorization, it must inform you of changes so that you can object. For sub-processors involved, the same data protection obligations apply as for the processor itself.

What does the Waste Catalogue Ordinance have to do with the DPA?

Nothing except the abbreviation. In data protection, AVV means the data processing agreement under Art. 28 GDPR. In waste law, AVV stands for the Waste Catalogue Ordinance (Abfallverzeichnis-Verordnung), which sets out types of waste and waste codes.