Selling Software to German Firms: The DPA and Security Checklist

Short answer: If your software processes personal data for a German customer, you are almost certainly their processor, and they will not sign without a data processing agreement under Article 28 GDPR, which they'll call an AVV (Auftragsverarbeitungsvertrag). Expect them to ask for a sub-processor list, where data is hosted, your technical and organisational measures (TOMs), how non-EU transfers are covered, and how you handle breaches and deletion. Having these ready as a trust page and a signable DPA can shorten a German procurement cycle from weeks of email to a single review.

Why German buyers are so thorough

German companies are not subject to a different GDPR, but their data protection officers, works councils and procurement teams tend to apply it to the letter. The German supervisory authorities' joint body, the Datenschutzkonferenz (DSK), sets the tone with short guidance papers. Its Kurzpapier Nr. 13 on processing on behalf of a controller reminds controllers that Article 28(1) requires them to check, before awarding the contract, that a processor offers "sufficient guarantees" of appropriate technical and organisational measures. That check is the buyer's legal duty, which is why they ask you so many questions.

What Article 28 requires in the contract

Article 28(3) lists what the DPA must contain. In plain terms, the processor:

processes personal data only on the customer's documented instructions, including for international transfers;
ensures staff with access are bound to confidentiality;
takes the security measures required by Article 32;
uses sub-processors only with the customer's prior specific or general written authorisation, and passes the same obligations down;
helps the customer respond to data subject requests;
assists with security, breach notification, DPIAs and prior consultation;
deletes or returns all personal data at the end of the service, as the customer chooses;
provides the information needed to demonstrate compliance and allows audits.

On sub-processors, Article 28(2) is specific: with a general authorisation, you must inform the customer of intended changes "thereby giving the controller the opportunity to object." Article 28(4) keeps you "fully liable" if a sub-processor fails.

The buyer-question list

These are the questions to expect, grouped the way a German questionnaire usually runs. Have a short, factual answer ready for each.

Contract and roles

Do you act as processor, or as controller for any purpose (for example product analytics)?
Can you provide a DPA (AVV) based on Art. 28 GDPR, ideally in German or bilingual?
Which law and jurisdiction govern the main contract?

Hosting and transfers

Where are production data, backups and logs stored? Name the provider and region.
Is any personal data accessed from outside the EU/EEA, including for support?
If yes, what is the transfer mechanism: an adequacy decision such as the EU-US Data Privacy Framework (with the recipient certified), or the Commission's standard contractual clauses plus a transfer impact assessment?

On the DPF: the EU General Court dismissed the Latombe challenge on 3 September 2025 and upheld the framework, and Mr Latombe appealed to the Court of Justice on 31 October 2025 (case C-703/25 P). We found no ruling on that appeal as of November 2026, and many German buyers still prefer EU hosting with no US access because it removes the question entirely.

Sub-processors

Full list: name, purpose, data categories, location.
How do you notify changes, and how long do customers have to object?

Technical and organisational measures (TOMs)

Access control: SSO, MFA, role-based access, joiner/leaver process.
Encryption in transit and at rest; key management.
Logging and monitoring; who can see production data.
Backups, restore tests, and recovery targets.
Vulnerability management, patching, penetration tests.
Certifications (ISO/IEC 27001, SOC 2) or, for smaller vendors, a clear written description.

Incidents, retention and exit

How fast do you notify the customer of a personal data breach, and through what channel?
Retention periods and the deletion concept (Löschkonzept).
Export format and deletion confirmation when the contract ends.

AI features

Do you use customer data to train models? If an AI provider is involved, it's a sub-processor and goes on the list, with its retention and training terms.

Trust page outline

A public trust page answers most of these before the buyer asks. For a small vendor, one well-organised page plus downloadable documents is enough.

Section	Contents
Summary	Two sentences: your role (processor), hosting region, contact for privacy questions
Hosting and architecture	Provider, region, backups location, high-level data flow diagram
Sub-processors	Table with name, purpose, data, location; "last updated" date; subscribe-to-changes form
Security measures	TOMs in plain language, grouped as above
Certifications and tests	What you hold, or a statement that you don't and what you do instead
DPA	Download link for your standard Art. 28 DPA, in English and German
Transfers	Whether any non-EU access exists and the mechanism used
Incidents	Notification commitment and status page link
AI and data use	Whether customer data trains any model; AI providers used
Contact	Privacy and security contact, DPO if appointed

Two practical tips:

Sign their DPA or offer yours, but read both. Large buyers often insist on their own template. Check audit rights, liability caps and sub-processor objection terms before agreeing.
Keep one source of truth. The sub-processor table on the trust page, the DPA annex and your actual infrastructure must match. Mismatches are the first thing a careful DPO spots.

This is a practical checklist, not legal advice for your contracts.

FAQ

Do I need a German-language DPA?

It isn't legally required, but many German buyers prefer one, and a bilingual version avoids translation questions in review. English-only can work with international companies.

Is hosting in Germany required?

No. EU hosting meets the GDPR's territorial expectations, and transfers outside the EU are possible with an adequate mechanism. German hosting is a preference some buyers state, not a legal rule.

Can I list my AI model provider as a sub-processor?

Yes, and you should, if it processes customer personal data for you. State what data it receives, where, how long it keeps it, and whether it may train on it.

What if a customer objects to a new sub-processor?

Your DPA should say what happens: commonly you discuss alternatives, and if none works the customer may terminate the affected service. Write this down before the first objection arrives.

If you'd like help turning your security answers into a clean trust page and DPA annex, describe your product and stack.