Order processing contracts with Dieter

are GDPR compliant & legally compliant contain all mandatory information are quick and easy you create with just a few clicks were developed by experts require no prior knowledge

Is GDPR compliant and legally secure Contains all
mandatory data
is simple
and fast
you create with a few clicks was developed by experts

We generate your legally compliant order processing contracts automatically and in just a few minutes. Create online now and download immediately.

With just a few clicks to your Data Processing Agreement (DPA)

  • Data processing agreements (DPAs) are not only a legal requirement of the GDPRbut a central building block for the protection and security of personal data.
  • The contracts you create are tailored to your needs and more secure than any template. Minimize your compliance risks and build trust with customers and partners.
  • Protect yourself from fines now by fulfilling your legal obligations quickly and easily.
  • Dieter was developed by TÜV-certified data protection officers and lawyers to cover your back and ensure compliance with GDPR .

Unsere Mitgliedschaften

Any questions?

As soon as you have personal data processed for you by an external service, you need a DPA. This is already the case if your company uses a cloud service provider or hosts the website externally.

Conversely, you also need a DPA if you process personal data for someone else.

A Data Processing Agreement (DPA) must contain specific elements in order to meet the requirements of GDPR .

This includes

  • the precise description of the nature and purpose of the data processing
  • the type of personal data
  • the groups of people concerned
  • the rights and obligations of both parties - client and processor
  • Regulations on the security of data processing, such as technical and organizational measures
  • Provisions on subcontracting relationships
  • Provisions on the obligation to report data breaches
  • Provisions for deletion or return of data after the end of processing
  • Provisions on the rights to verify compliance with data protection regulations.


A DPA thus serves as a legal basis that ensures that data processing is carried out in accordance with GDPR and that the privacy of the data subjects is protected.

Drawing up data processing agreements (DPAs ) for a company is no easy task for a legal layperson and requires basic knowledge of data protection law, knowledge of case law and legal structuring options.

In order to create such a contract yourself, it is first necessary to create a sound basis through thorough research and an understanding of the requirements as well as the available templates from data protection authorities. On this basis, a suitable template can be selected and adapted according to the specific needs of the data processing, whereby particular emphasis must be placed on the precise definition of processing details, security measures, rights and obligations. It is also important to regularly check that the data processing agreement is up to date and to make adjustments in line with the latest data protection regulations, as well as to carefully document the creation process in order to be prepared for any inspections by supervisory authorities.

However,templates often contain provisions that are unfavorable or inadmissible for your specific case. The independent creation of DPAs carries the risk of suffering legal disadvantages due to a lack of sufficient knowledge.

When Dieter creates order processing contracts, all necessary information is collected by asking simple questions.

In concrete terms, this means that you click through questions step-by-step, which in most cases can be answered with yes or no (or a predefined selection). 

With these clever questions and well thought-out answer options, Dieter ensures that all mandatory information is included in the DPA .

No specialist or prior knowledge is required to answer the questions.

The result is a complete contract that contains all the necessary information and can be sent directly to the contractual partner.

The AVVs can be adapted again and again and thus react flexibly to actual or technical changes. Dieter always keeps an eye on legal changes and always provides you with the latest legally compliant version.

We generally recommend having AVVs drawn up by an expert. Formal requirements for the author do not exist, however.

The preparation requires a high degree of accuracy and requires numerous different factors to be considered. In addition, current developments in legislation and case law must be taken into account in order to create a legally compliant and individually favorable DPA .

The absence of a DPA or the existence of inadequate provisions in a DPA can have serious consequences. This is a violation of applicable data protection regulations (in Germany, in addition to GDPR , the BDSG is also particularly relevant), which can be punished with a fine of up to 20 million euros or 4% of the annual turnover achieved worldwide - depending on which amount is higher.

In addition, the lack of a DPA can affect the trust of your customers and partners and give the impression that your company does not take data protection requirements seriously.

All companies must comply with the requirements of the GDPR. This applies regardless of the number of employees and thus even to sole proprietors and solo self-employed. With Dieter, you don't have to worry anymore. We take care of everything you need to fulfill your legal obligation.

Warning letters due to GDPR violations have increased steadily in recent years. This is exemplified by the numerous warnings for the GDPR-compliant use of Google Fonts in the summer of 2022. Irrespective of the fact that some of these warnings were not lawful, they were based on a decision by the LG Munich in January 2022. In addition, the European Court of Justice (ECJ) ruled at the end of 2022 that consumer associations are generally entitled to issue warnings for a GDPR violation. These (and other) court decisions suggest further waves of warning letters. These can affect all companies that do not take care of their legal obligations.

A GDPR-compliant website is the first step in effectively protecting yourself from warning letters. In 2022, there were already countless warnings due to the unlawful use of Google fonts. Dieter not only takes care of your data protection concerns, but also creates your Legal notice.

The data protection supervisory authorities have started to carry out random audits. For companies with fewer than 20 employees, the statistical risk of being affected by one is over 10:1.

In Germany, around 85% of all German companies were victims of a cyber attack in 2022. Each affected company incurred average costs of around €20,000 per incident. In addition, around 20% of customers terminate their contracts with affected companies or delete their accounts. Implementing mandatory technical and organizational measures (TOMs) alone significantly reduces the risk of being affected.

Almost all German companies use services from companies (Google, Microsoft, Meta, Amazon, etc.) with which an international data protection contract (SCC/JC) must be concluded. In addition, digital service providers necessarily "receive" personal data from their clients for the service they offer. In these cases, it is imperative to check whether and with whom so-called order processing agreements (AVVs) must be concluded. Dieter takes over this check and also always provides the correct contract.

79% of Internet users are afraid of "data misuse". And quite rightly so! Because since 2022, personal data has been legally equivalent to a currency. Awareness of this is growing all the time. This data should be just as secure as a bank account. And that is what the implementation of the GDPR ensures.

More than 2/3 of the participants in a study on "Consumer data and data protection" (commissioned by McKinsey & Company) stated that they would no longer want to be a customer of or work with a company that does not protect their data or passes it on without a legal basis. It also proves that responsible handling of personal data and compliance with all legal obligations is a clear competitive advantage.

It refers to the fact that every person has the right to determine for themselves what personal (and therefore very private) data about them is collected, stored and used. It also provides the opportunity to prevent abuse, fraud and discrimination. Data protection is thus an essential component of the (fundamental) right to informational self-determination under the German Basic Law. This right protects the privacy, identity and freedom of every person and is therefore essential for a democratic society. Respecting it should be a matter of course for every company.

What our customers say

"Data protection, but simple! Dieter takes you by the hand right from the start and guides you through the entire data protection process. For us, the all-in-one tool we were looking for and found with Dieter."

Information Technology and Services

"Data protection for SMEs is quickly done with Dieter. Dieter explains everything you need to know in an entertaining conversation. If he needs information to create a document (e.g. Privacy Policy), he asks at the appropriate time. This doesn't give the dusty impression of a long form with blocks of text at the end. "

"The intuitive guidance allows you to work through each topic step by step. You can stop at any point and continue later if you are interrupted. All in all, a really good solution for SMEs. Once you have entered everything, everything is securely organized digitally and can be accessed/presented at any time. I'm really very happy to have found this software." 

"Data protection should be implementable for every company! Without prior knowledge, affordable and with a small investment of time. That's exactly what this service offers."

Damian W.
Manager in the field: AI

That's why Dieter!

Dieter does the data protection. And you do your work.

All required GDPR documents

Dieter creates all necessary documents for the implementation of the GDPR, such as your privacy policy or even the directory of processing activities. The complex requirements of the GDPR are converted in an understandable way and queried via simple yes/no answer options.

The right processes for the job

Dieter does not leave you alone, but tells you what to do, when and how. Only with the right processes can you achieve effective data protection and save time and money in the process. You too can benefit from our automated solutions for your company.

Making decisions without prior knowledge

The integrated data protection management system allows you to start immediately without any prior knowledge. Dieter guides you understandably through all legal requirements and collects your results in one place. Complete your tasks "step by step" and in just 10 minutes per week.

Still undecided?
Book your privacy journey now and check in with Dieter.

Sometimes you just want to unstrap your backpack and head off on an adventure. You pack up and see what happens. It is often unclear when you arrive where and how. In this case, that's not a problem either. The journey itself is the destination.

However, on your journey to meet all data protection requirements, this "backpack strategy" is not recommended. You should know exactly which stages to take and when.

We plan your trip like a good travel agency. All inclusive, of course. Dieter takes the role of your guide and accompanies you from the beginning. This may sound a bit boring. But do you really want to experience an adventure with an uncertain outcome?