Purpose
IT contracts regularly contain clauses that fail in the review of standard terms and conditions of content (Sections 305 et seq. of the German Civil Code (BGB)), disregard GDPR obligations, or create disproportionate allocations of liability. This skill identifies the typical points of failure along a structured review scheme.
⚠️ Currency (as of 2026-07): Since 12.09.2025 , the Data Act (Regulation (EU) 2023/2854) has been applicable. In every IT contract review, it must be processed as a separate review step (see Step 3a) and applies regardless of whether personal data are affected.
- Art. 3(1) (access by design) applies only to connected products placed on the market after 12 September 2026 — that is, only in a few weeks. For existing products , this obligation does not apply; the contractual access and provision obligations of Articles 4 and 5 are to be separated from this.
- Art. 5: users may require that data be passed on to a third party . Such requests must be processed within the statutory time limit; trade secrets may justify a restriction, but only under the conditions of the Regulation and with a documented justification.
- Art. 14 et seq.: public bodies may, in the event of exceptional need , request data — a separate type of claim that is often overlooked.
- Art. 13: review of unfairness of unilaterally imposed data access clauses in B2B contracts, alongside Sections 305 et seq. of the German Civil Code (BGB).
- Art. 23–31: switching between data processing services; switching charges cease entirely by 12 January 2027, until then only reduced on a cost basis. Art. 25 requires contractual exit support (see skill
cloud-auftragsverarbeitung).- German Data Act Implementation Act (DADG): Bundestag 26.03.2026, Federal Law Gazette 29.05.2026; the competent authority is the Federal Network Agency (announcement 30 May 2026). In the same package, the German implementation act for the Data Governance Act was adopted (BNetzA supervision over data intermediation services and data altruism organisations).
Individual provisions of the DADG must be verified against the promulgated text before use directed at clients.
[unverifiziert - prüfen]
Inputs
- Contract type (SaaS, cloud hosting, outsourcing, individual software development, maintenance)
- Contract role (provider / customer)
- Size class (B2B / B2C)
- GDPR-relevant (personal data processed?)
- Existing templates (EVB-IT, BVB, BITKOM, own)
- Data Act reference: Does the contract concern a connected product or a related service (IoT)? If yes: date of placing on the market (before or after 12.09.2026)
- Data Act reference: Is it a data processing service (cloud/SaaS) within the meaning of Art. 23 et seq.?
Procedure
1. Classification of contract type
Decisive for applicable law:
| Contract type | Legal nature | Focus |
|---|---|---|
| SaaS / cloud hosting | Lease or usufructuary lease agreement (Sections 535 et seq. BGB), disputed | Availability, data surrender |
| Individual software development | Contract for work and services (Section 631 BGB) | Acceptance, liability for defects |
| Maintenance / support | Service contract (Section 611 BGB) | Response times, no success owed |
| IT outsourcing | Mixed contract (service + work + lease) | Agreed service levels |
| License agreement | Atypical contract (Sections 311a, 631 by analogy) | Scope of the license |
2. Standard terms review (Sections 305 et seq. BGB)
Templates from a number of contracts are standard terms. Also in B2B , Sections 305c, 307 BGB apply (via Section 310(1) sentence 2 BGB).
Typical problematic clauses:
- Exclusion of liability for simple negligence with regard to cardinal contractual obligations typical of the contract → Section 307 BGB, invalid.
- Lump-sum limitation to annual remuneration → generally permissible, but carefully in proportion.
- Contract amendment by the provider without a right of objection → Section 308 no. 5 BGB.
- "We are liable only to the extent legally mandatory" → transparency requirement Section 307(1) sentence 2.
3. GDPR interlinking
Data processing agreement (Art. 28 GDPR)
If personal data are processed: DPA pursuant to Art. 28(3) GDPR mandatory. Mandatory contents:
- Subject matter and duration of the processing
- Nature and purpose of the processing
- Categories of data and categories of data subjects
- Obligations and rights of the controller
- Measures pursuant to Art. 32 GDPR
- Sub-processors
- Assistance with data subject requests
- Deletion / return after termination
- Audit rights of the controller
Third-country transfer
US cloud providers: TIA + SCC + possibly EU-US Data Privacy Framework. Note: Schrems II situation.
3a. Data Act review (Regulation (EU) 2023/2854, applicable since 12.09.2025)
This step must always be completed. The Data Act applies regardless of personal data reference of the data and applies alongside the GDPR and general terms and conditions law.
a) Determine the scope of application.
| Subject matter of the contract | Relevant provisions |
|---|---|
| Connected product / related service (IoT) | Art. 3–5 (access and provision to users and third parties) |
| Data processing service (cloud, SaaS, IaaS, PaaS) | Art. 23–31 (switching), in particular Art. 25, 29 |
| B2B contract with unilaterally imposed data clauses | Art. 13 (unfairness control) |
| Any data holder | Art. 14 et seq. (requests by public bodies in exceptional need) |
b) Deadline 12.09.2026 — the decisive distinction. The obligation for access by design under Art. 3(1) — to design connected products in such a way that user data is directly, easily and securely accessible — applies only to products placed on the market after 12.09.2026. For existing products there is no retrofit obligation under Art. 3(1).
Do not confuse: The contractual provision obligations towards users (Art. 4) and towards third parties at the user's request (Art. 5) are not tied to this deadline. The conversion of contracts must therefore be separated from product design.
c) Re-paper IoT contracts (Art. 3–5). Review points:
- Pre-contractual information pursuant to Art. 3(2), (3): type, scope, format and frequency of the data generated; how the user accesses it; whether the data holder uses it
- User's right of access (Art. 4) reflected in the contract, free of charge and without unreasonable obstacles
- Passing on to third parties at the user's request (Art. 5) governed — including processing procedure and compliance with deadlines
- Usage restrictions of the data holder (e.g. no competing product from user data) formulated correctly and not excessively
- Trade secrets: restrictions on data transfer are possible, but only under the conditions of the Regulation, with protective measures and documented justification. A blanket reservation of confidentiality does not hold.
d) Operationalise Art. 5 requests. A user's request for transfer to a third party must be within the statutory period to be processed. Required are a defined input channel, a review path (identity, scope, trade secrets, excluded recipients) and documentation. The specific deadline length must be verified against the text of the regulation. [unverifiziert - prüfen]
e) Requests from public authorities (Art. 14 et seq.). In the case of exceptional need public authorities may request data. The contract should govern who receives such requests, how they are reviewed and how the contracting parties are informed.
f) Clause review under Art. 13. Unilaterally imposed clauses on data access, use and liability in B2B contracts are subject to an independent review of unfairness. It must additionally be reviewed under §§ 305 et seq. BGB and applies even where standard terms review does not reach.
g) Jurisdiction. The competent German authority under the DADG (Federal Law Gazette 29.05.2026) is the Federal Network Agency, not the data protection supervisory authority. Data Act and GDPR proceedings run separately.
4. Service Level Agreements (SLA)
- Availability: percentage figure (e.g. 99.5%) with calculation methodology
- Response time / recovery time
- Maintenance windows (planned / unplanned)
- Penalties for falling short (credits, special right of termination)
- Reporting / monitoring
5. Migration and termination clauses
Critical in cloud/SaaS contracts:
- Data handover in a structured, commonly used and machine-readable format, at no additional cost
- Transition period with the provider's cooperation
- Deletion of the data after the end of the contract with proof
- Avoidance of vendor lock-in (data export interfaces)
In the case of data processing services (cloud, SaaS), since the Data Act these points are no longer merely a matter for negotiation but prescribed by law:
- Art. 25: contractual exit support — switching period, transition period, export format, description of the data that can be exported, deletion at the previous provider
- Art. 29: Switching charges cease entirely by 12.01.2027; until then only cost-based reduced charges are permissible. Flat-rate exit, migration or egress fees are already impermissible now and must be removed from the contract.
In-depth review: Skill cloud-auftragsverarbeitung.
6. Open-source compliance
- Inventorying of OSS components used (SBOM)
- License compatibility (GPL vs. MIT vs. Apache)
- Copyleft risk upon distribution
7. Liability and insurance
- Clearly define cardinal obligations
- Cap at annual remuneration (typically 1 to 2 x)
- Exceptions for intent, gross negligence, life/limb, ProdHaftG
- Proof of insurance (cyber, professional liability)
Sources
Statutes
- §§ 305–310 BGB
- § 611 BGB, § 631 BGB, § 535 BGB
- Art. 28 GDPR
- Art. 32 GDPR, Art. 44 et seq.
- UrhG (licenses)
- Regulation (EU) 2023/2854 (Data Act) — applicable since 12.09.2025; Art. 3 (access by design, only for products placed on the market after 12.09.2026 ), Art. 4, 5 (provision to users and third parties), Art. 13 (unfair terms B2B), Art. 14 et seq. (public bodies, exceptional need), Art. 23–31 (switching, in particular Art. 25 and Art. 29)
- Data Act Implementation Act (DADG) — Bundestag 26.03.2026, Federal Law Gazette 29.05.2026; competent authority Federal Network Agency (announcement 30.05.2026). Individual provisions
[unverifiziert - prüfen] - German implementation act on the Data Governance Act — adopted in the same package on 26.03.2026; BNetzA supervises data intermediation services and data altruism organisations
[unverifiziert - prüfen]
Templates / standards
- EVB-IT (Supplementary Contract Terms for IT) – public procurement
- BITKOM model contracts
- BVB (Special Contract Terms)
Case law
- BGH, judgment of 15.11.2006 – XII ZR 120/04, NJW 2007, 2394 = MMR 2007, 243 (ASP/SaaS = lease agreement), dejure.org
- "Cloud liability"
[unverifiziert – prüfen]— the citation previously given here, "BGH, judgment of 18.12.2009 – V ZR 130/08, NJW 2010, 1962", is incorrect: there is no BGH decision V ZR 130/08 dated 18.12.2009; V ZR 130/08 is BGH, judgment of 06.02.2009 (transfer of land, § 138 BGB, NJW 2009, 1346) and does not concern cloud liability. A relevant leading decision is still outstanding; until further notice, liability issues must be derived from §§ 280, 535, 536a BGB and standard terms review
Output format
IT-VERTRAGSPRÜFUNG — <Vertragsbezeichnung> — <Datum>
I. Vertragstyp [SaaS / Werkvertrag / Outsourcing / …]
Anwendbares Recht: <…>
II. AGB-Kontrolle [✓ / ⚠️ / ❌]
Problemklauseln: <…>
III. DSGVO
AVV vorhanden + vollständig: [✓ / 🔴 lückenhaft]
Drittlandtransfer: [N/A / SCC / DPF — TIA-Status]
III-a. Data Act (VO (EU) 2023/2854)
Anwendungsbereich: [IoT Art. 3–5 / Cloud Art. 23–31 / nur Art. 13 / N/A]
Inverkehrbringen des Produkts: [vor / nach 12.09.2026 → Art. 3 Abs. 1?]
Nutzerzugang Art. 4 / Dritte Art. 5: [geregelt / 🔴 fehlt]
Art.-5-Prozess + Frist: [etabliert / 🔴 fehlt]
Geschäftsgeheimnis-Vorbehalt: [begründet / ⚠️ pauschal]
Wechselentgelte Art. 29: [keine / kostenbasiert / 🔴 pauschal]
Ausstiegshilfe Art. 25: [✓ / 🔴]
Art. 13 Klauselkontrolle: [✓ / ⚠️]
Zuständige Behörde: BNetzA (DADG)
IV. SLA
Verfügbarkeit, Reaktionszeit: <…>
Sanktionen: <…>
V. Migration / Beendigung
Datenherausgabe: [✓ / 🔴]
Löschnachweis: [✓ / 🔴]
VI. Open Source
SBOM: [vorhanden / fehlt]
Lizenz-Verträglichkeit: [✓ / ⚠️]
VII. Haftung
Cap: <EUR oder x Jahresvergütung>
Ausnahmen: [vollständig / unvollständig]
Verhandlungsstrategie: <…>
Risks / typical errors
- SaaS without a DPA — GDPR infringement, risk of fines under Art. 83 GDPR.
- Third-country transfer without a TIA — Schrems II risk.
- Limitation of liability too broad — § 309 No. 7 BGB, § 307 BGB.
- Data surrender clause missing — vendor lock-in as the provider's negotiating lever.
- Open source without a compliance review — copyleft risk on later distribution.
- "We use the vendor standard" — without one's own review there is no legitimate expectation of protection.
- Data Act not reviewed at all — it has applied since 12.09.2025 and irrespective of personal data. An IT contract review that only works through standard terms law and the GDPR has been incomplete since that date.
- Art. 3(1) applied to existing products — the obligation of access by design applies to only connected products placed on the market after 12 September 2026. Anyone who assumes it applies to legacy products is recommending retrofitting that is not legally required.
- Reverse error: Articles 4 and 5 linked to the cut-off date of 12 September 2026 — the provision obligations towards users and third parties do not depend on the placing of the product on the market. Anyone who transfers the cut-off date to them underestimates what needs to be done today.
- Article 5 requests without a process — user requests to pass data on to third parties are subject to deadlines; without a defined intake channel and review path, the deadline passes unnoticed.
- Blanket trade secret reservation — trade secrets can restrict data sharing, but only under the conditions of the Regulation, with protective measures and a documented case-by-case justification. A blanket clause does not hold.
- Leaving switching fees in the cloud contract — they are eliminated entirely by 12 January 2027; until then only cost-based reduced fees are permissible. Flat-rate exit and egress fees are already impermissible.
- Exit clause under Article 25 missing — the switching period, transition period, export format and deletion at the former provider must be regulated by contract .
- Article 13 Data Act equated with standard terms review — this is an independent abuse review for data clauses unilaterally imposed, which applies alongside sections 305 et seq. of the German Civil Code (BGB).
- Requests from public bodies (Articles 14 et seq.) not considered — in the event of exceptional need there is a separate claim to disclosure, for which neither jurisdiction nor process is regulated.
- Wrong supervisory authority addressed — for the Data Act, the competent authority in Germany is the Federal Network Agency (DADG, Federal Law Gazette 29 May 2026), not the data protection supervisory authority.