Data Processing Agreements and US Transfers: How DACH Customers Negotiate — and Where the Data Privacy Framework Stands

In DACH enterprise deals, the data processing agreement is not an annex that legal signs off in passing. It is negotiated — often by the customer's data protection officer, often on the customer's own template, and often with the same intensity as the commercial terms. For SaaS vendors, the DPA is where many deals gain or lose weeks.

The legal minimum is set by Article 28 GDPR: a contract that defines the subject matter, duration, nature and purpose of processing, the data categories, and the processor's obligations — acting only on documented instructions, confidentiality, security measures, controlled use of sub-processors, support for data subject rights, deletion or return, and audits. German and Austrian customers take each of these words literally.

The Points That Decide Negotiations

• Technical and organisational measures: customers expect a concrete annex, not a reference to a policy page — and they compare it with your certifications.
• Sub-processors: a current list, advance notice of changes, and a genuine right to object. Notice periods of around 30 days are common requests.
• Audit rights: vendors prefer certificates and audit reports; customers want the right to inspect. The usual compromise: reports first, on-site audits for cause.
• Breach notification: the GDPR requires notification without undue delay; customers often ask for fixed hours, because their own 72-hour clock depends on yours.
• Liability: buyers push for uncapped or separately capped data protection liability — the most contested commercial point in the DPA.
• Data location: processing within the EU or EEA is increasingly a requirement, not a preference — especially for banks, insurers, and the public sector.

Transfers to the United States: The Legal Architecture

Transfers of personal data outside the EEA require a legal basis under Chapter V of the GDPR. For the United States, two mechanisms matter. Since July 2023, the EU-US Data Privacy Framework (DPF) provides an adequacy decision for transfers to US companies certified under it. Independently, the EU Standard Contractual Clauses of 2021 remain available — combined with a transfer impact assessment, as required since the Court of Justice's Schrems II judgment.

The DPF has survived its first court test. In September 2025, the EU General Court dismissed the action brought by French MP Philippe Latombe and confirmed the validity of the adequacy decision. The case is not over: an appeal has been pending before the Court of Justice since autumn 2025, and a ruling is not expected before late 2026 or 2027. The Court of Justice invalidated both predecessor frameworks, Safe Harbor and Privacy Shield — which is why many DACH customers ask not only whether a vendor is certified, but what happens if the framework falls.

“

The Data Privacy Framework is valid law. DACH customers still negotiate as if they had read the history of its two predecessors — because they have.

A Robust Transfer Setup

1. 01US vendors: certify under the DPF and incorporate the Standard Contractual Clauses as a fallback mechanism in the DPA — if the adequacy decision falls, the contractual basis remains.
2. 02Document a transfer impact assessment that covers US surveillance law and your actual data flows, including support access from outside the EEA.
3. 03Offer EU hosting and, where possible, EU-based support and administration for customers with strict requirements.
4. 04Describe your process for government access requests transparently — how requests are reviewed, challenged, and reported.
5. 05Consider customer-managed encryption keys for sensitive data categories; it changes the risk assessment materially.

Switzerland

Swiss customers apply the revised Federal Act on Data Protection, which has been in force since September 2023. For the United States, the Federal Council has recognised the Swiss-US Data Privacy Framework since September 2024, so transfers to certified US companies are also possible without additional safeguards from a Swiss perspective. Swiss customers nevertheless usually expect the same contractual fallback as EU customers.

Conclusion

In the DACH market, data protection is part of the product, and the DPA is part of the sales cycle. Vendors that arrive with a complete, German-language DPA, a clear sub-processor list, and a transfer setup that survives a court ruling shorten negotiations and win trust with data protection officers. Aegiron Capital Group helps market entrants prepare their contract and data protection documentation for DACH procurement; legal advice comes from the law firm you engage.