No job like any other: Order data processing (ADV)

In Germany, Section 11 of the Federal Data Protection Act and Section 80 of the Tenth Book of the Social Security Act regulate 'commissioned data processing' or 'commissioned data processing (ADV)'. They determine the 'outsourcing' of data processing orders to external third parties.

Since 2009, the Federal Data Protection Act has provided the legal framework for data processing with a ten-point rule that covers issues such as deletion, the obligation to report and monitoring rights.

Depending on the type of data collected, the client must ensure that the contractor is certified for the task and that it implements a security concept. This is usually done by providing written information. Only then may the client transmit personal data. Under liability law, it is usually not the service provider who is responsible for breaches, but still the client.