AVV (Auftragsverarbeitungsvertrag / Data Processing Agreement)
Also known as: Auftragsverarbeitungsvertrag · Data Processing Agreement · DPA
An AVV is the GDPR Article 28 data processing agreement between a controller (e.g. a driving school) and a processor (e.g. RoadReview). It defines purpose, safeguards, and responsibilities for handling personal data.
Article 28 of the GDPR obliges every controller who has personal data processed by a service provider to enter into a written or electronic agreement (DPA — in German Auftragsverarbeitungsvertrag, AVV). Mandatory contents:
- Subject matter and duration of the processing,
- Type and purpose of the processing,
- Categories of personal data and of data subjects,
- Technical and organisational safeguards (TOMs),
- Rules on sub-processors,
- Deletion or return arrangements at the end of the contract.
For driving schools this matters because student data is particularly sensitive: dates of birth, addresses, sometimes geo-position and audio recordings. A clean DPA with the software vendor is mandatory — supervisory authorities ask for it during an audit.
In English copy on this site we use “DPA” with “(AVV)” on first mention so readers searching for the German abbreviation still hit the page.
Sources
Updated