Snapshot 187944
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING AGREEMENT FOR CLOUD SERVICES, SAP SUPPORT AND SAP SERVICES ("DPA")
1. DEFINITIONS
1.1. "Cloud Service" means any distinct, hosted, supported and operated on-demand solution as set out in the
Agreement.
1.2. "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly
with others, determines the purposes and means of processing of Personal Data.
1.3. "Data Protection Law" means the applicable legislation protecting the fundamental rights and freedoms of
natural persons and their right to privacy with regard to the processing of Personal Data under the Agreement.
1.4. "Data Subject" means an identified or identifiable natural person as defined by Data Protection Law.
1.5. "EU Standard Contractual Clauses" means the unchanged standard contractual clauses, published by the
European Commission, reference 2021/914 or any subsequent final version thereof which will automatically
apply.
1.6. "GDPR" means the General Data Protection Regulation (EU) 2016/679.
1.7. "List of Subprocessors" means a list of the name, address and role of each Subprocessor SAP uses to
provide SAP Services.
1.8. "My Trust Center" means information available on the SAP support portal (see:
https://support.sap.com/en/my-support/trust-center.html) or any subsequent website(s) made available by
SAP to Customer.
1.9. "Personal Data" means any information relating to a Data Subject. For the purposes of Cloud Services,
Personal Data is a sub-set of Customer Data (as defined in the Agreement).
1.10. "Personal Data Breach" means a confirmed breach of SAP's security leading to the accidental or unlawful
destruction, loss, alteration, unauthorized disclosure of or unauthorized third-party access to Personal Data
for which a Processor is required under Data Protection Law to provide notice to the Controller.
1.11. "Processor" means a natural or legal person, public authority, agency or other body which processes personal
data on behalf of the controller, be it directly as processor of a controller or indirectly as subprocessor of a
processor which processes personal data on behalf of the controller.
1.12. "Professional Services" means implementation services, consulting services and/or other related services
as set out in the Agreement and may also be referred to in the Agreement as "Consulting Services" or
"Services".
1.13. "SAP Services" means Cloud Services, Professional Services or SAP Support as set out in the Agreement.
1.14. "SAP Support" means SAP support services as set out in the Agreement.
1.15. "Subprocessor" or "sub-processor" means SAP's Affiliates, SAP SE, SAP SE Affiliates and third parties
engaged by SAP, SAP SE or SAP SE's Affiliates in connection with SAP Services to process Personal Data
under this DPA.
1.16. "Technical and Organizational Measures" means the following: (a) for Cloud Services, the technical and
organizational measures included in the relevant “Security Measures for Cloud Services” document published
on My Trust Center or SAP agreements website (see: https://www.sap.com/about/trust-
center/agreements/SecurityMeasures); and (b) for SAP Support and Professional Services, the technical and
organizational measures included in the “Technical and Organizational Measures for SAP Support and
Professional Services” document published on My Trust Center or SAP agreements website (see:
https://www.sap.com/about/trust-center/agreements/on-premise/data-processing-
agreements.html?sort=latest_desc&tag=agreements:data-processing-agreements/toms-on-premise-
support).
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 1 of 10
1.17. "Third Country" means any country, organization or territory not acknowledged by the European Union under
Article 45 of GDPR as a safe country with an adequate level of data protection.
2. BACKGROUND
2.1. Scope
2.1.1. This DPA is incorporated into and forms part of the Agreement between SAP and Customer and sets forth the
terms and conditions related to the processing of Personal Data by SAP and its Subprocessors in connection
with delivering SAP Services.
2.1.2. This DPA applies only to Personal Data which is processed by SAP or its Subprocessors on behalf of the
Customer as part of providing SAP Services.
2.1.3. Where SAP or a Subprocessor makes available non-production environments of SAP Services, Customer
shall not store Personal Data in such environments. Non-production environments are not intended for the
processing and storage of Personal Data and are excluded from the scope of this DPA.
2.2. Structure
Schedules 1 and 2 are incorporated into this DPA. They set out the agreed subject-matter, the nature and
purpose of the processing, the type of Personal Data, categories of Data Subjects and the applicable Technical
and Organizational Measures.
2.3. Governance
2.3.1. SAP acts as a Processor under this DPA. Customer and those entities that Customer authorizes to use SAP
Services under the Agreement act as a Controller or Processor. For the purposes of this DPA, where Customer
acts as Processor, it does so under the instructions of its Controller(s).
2.3.2. Customer acts as a single point of contact and shall obtain any relevant authorizations, consents, instructions
and permissions for the processing of Personal Data in accordance with this DPA, including, where applicable,
approval to use SAP as a Processor. Where authorizations, consents, instructions and permissions are
provided by Customer, these are provided not only on behalf of the Customer but also on behalf of any other
Controller. Where SAP informs or gives notice to Customer, such information or notice is deemed received by
those Controllers permitted by Customer to use SAP Services. Customer shall forward such information and
notices to the relevant Controllers.
3. SECURITY OF PROCESSING
3.1. Technical and Organizational Measures
SAP has implemented and will apply the Technical and Organizational Measures. Customer has reviewed the
appropriateness of such measures before it executes an Agreement that incorporates this DPA.
3.2. Changes
3.2.1. SAP applies the Technical and Organizational Measures to SAP's entire customer base hosted out of the
same data center or receiving the same SAP Services. SAP will review and may change the Technical and
Organizational Measures at any time without prior notice so long as such changes maintain an overall level of
security for Personal Data that is comparable or better and is not diminished. For example, new measures
may be added or individual measures may be replaced by new measures that serve the same purpose. SAP
will publish such updated versions of Technical and Organizational Measures on My Trust Center and where
available Customer may subscribe to receive e-mail notification of updated versions.
4. OBLIGATIONS
4.1. Instructions from Customer
SAP will process Personal Data only in accordance with documented instructions from Customer. In entering
into the Agreement and by using the SAP Service, Customer instructs SAP to process Personal Data to
provide and support the SAP Service as set out in the Agreement (including this DPA). SAP will use
reasonable efforts to follow any other Customer instructions, as long as they are technically feasible, do not
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 2 of 10
require changes to the SAP Service and are in accordance with Data Protection Law. If SAP cannot comply
with an instruction or is of the opinion that an instruction infringes Data Protection Law, SAP will notify
Customer (e-mail permitted) without undue delay.
4.2. Processing on Legal Requirement
SAP may also process Personal Data where required to do so by applicable law. In such a case, SAP shall
inform Customer of that legal requirement before processing unless that law prohibits such information on
important grounds of public interest.
4.3. Personnel
To process Personal Data, SAP and its Subprocessors shall only grant access to authorized personnel who
have committed themselves to confidentiality. SAP and its Subprocessors will regularly train personnel having
access to Personal Data in applicable data security and data privacy measures.
4.4. Data Subject Requests and Cooperation
4.4.1. SAP shall provide functionality for production systems of the Cloud Service that supports Customer's ability to
correct, delete or anonymize Personal Data from a Cloud Service, or restrict its processing in line with Data
Protection Law. Where such functionality is not provided as part of the production systems of the Cloud
Service, SAP will correct, delete or anonymize any Personal Data, or restrict its processing, in accordance
with the Customer's instruction and Data Protection Law.
4.4.2. At Customer's request, SAP will reasonably cooperate with Customer and Controllers in dealing with requests
from Data Subjects or regulatory authorities regarding SAP's processing of Personal Data or any Personal
Data Breach. If SAP receives a request from a Data Subject in relation to the Personal Data processed
hereunder, SAP will promptly notify Customer (where the Data Subject has provided information to identify
the Customer) via e-mail and shall not respond to such request itself but instead ask the Data Subject to
redirect its request to Customer.
4.4.3. In the event of a dispute with a Data Subject as it relates to SAP's processing of Personal Data under this
DPA, the Parties shall keep each other informed and, where appropriate, reasonably co-operate with the aim
of resolving the dispute amicably with the Data Subject.
4.5. Personal Data Breach Notification
SAP will notify Customer without undue delay after becoming aware of any Personal Data Breach and provide
reasonable information in its possession to assist Customer to meet Customer's obligations to report a
Personal Data Breach as required under Data Protection Law. SAP may provide such information in phases
as it becomes available. Such notification shall not be interpreted or construed as an admission of fault or
liability by SAP.
4.6. Assessments Pursuant to Data Protection Law
If, pursuant to Data Protection Law, Customer (or its Controllers) are required to perform a data protection
impact (or similar) assessment or prior consultation with a regulator, at Customer's request, SAP will provide
such documents as SAP makes generally available for SAP Services (for example, this DPA, the Agreement,
Audit Reports and Certifications). Any additional assistance shall be mutually agreed between the Parties.
4.7. Records of Processing
Each party is responsible for its compliance with its documentation requirements, in particular maintaining
records of processing where required under Data Protection Law. Each party shall reasonably assist the other
party in fulfilling its documentation requirements, including providing the necessary information in a manner
reasonably requested by the other party (such as using an electronic system), in order to enable compliance
with any obligations related to maintaining records of processing.
5. DATA EXPORT AND DELETION
5.1. Export and Retrieval
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 3 of 10
If and to the extent SAP hosts Personal Data in a Cloud Service, during the Subscription Term of such Cloud
Service and subject to the Agreement, Customer may export and retrieve its Personal Data in a standard
format. Export and retrieval may be subject to technical limitations, in which case SAP and Customer will find
a reasonable method to allow Customer access to Personal Data.
5.2. Deletion
5.2.1. Before the Subscription Term of the Cloud Service expires, Customer shall perform one final data export which
constitutes a final return of Personal Data from the Cloud Service.
5.2.2. At the end of the Agreement, Customer hereby instructs SAP to delete the Personal Data remaining with SAP
(if any) within a reasonable time period in line with Data Protection Law (not to exceed 6 months), unless
applicable law requires retention.
6. CERTIFICATIONS AND AUDITS
6.1. Customer Audit
Customer may audit SAP's compliance with the Technical and Organizational Measures relevant to Personal
Data processed by SAP ("Customer Audit") on request only if:
(a) SAP has not provided sufficient evidence of its compliance with the Technical and Organizational
Measures through providing either (i) a certification as to compliance with ISO 27001 or other standards
(scope as defined in the certificate); or (ii) where applicable, in respect of Cloud Services a valid ISAE3402
or ISAE3000 or other SOC1-3 attestation report either through its third party auditor or through My Trust
Center ("Audit Reports and Certifications"); or
(b) a Personal Data Breach has occurred; or
(c) an audit is formally requested by Customer's data protection authority; or
(d) Data Protection Law sets out a direct audit right.
6.2. Audit Specifications
6.2.1. Prior to initiating a request for audit, Customer shall review SAP's Audit Reports and Certifications. Customer
Audits shall be performed by Customer or its independent third party auditor (reasonably acceptable to SAP
and excluding any third party auditor who is either a competitor of SAP or not reasonably qualified). Customer
shall provide at least 60 days advance notice of any audit unless Data Protection Law or a Customer´s data
protection authority requires shorter notice.
6.2.2. The start date, timeframe and scope of any Customer Audit shall be mutually agreed between the parties
acting reasonably. Unless Data Protection Law or Customer´s data protection authority require more frequent
audits, the frequency of a Customer Audit shall not exceed once every 12 months.
6.2.3. SAP resources to support Customer Audits shall be limited to a maximum equivalent of 3 business days in
relation to Cloud Services and 1 business day in relation to other SAP Services. Customer Audits shall take
place during SAP's normal business hours, not disrupt SAP's normal business operations and be subject to
SAP's reasonable confidentiality requirements.
6.2.4. Customer shall provide any audit report resulting from a Customer Audit to SAP. The results of any Customer
Audit shall be treated as SAP Confidential Information.
6.2.5. Customer shall bear SAP's reasonable costs of any Customer initiated audit unless such audit reveals a
material breach by SAP of this DPA, then SAP shall bear its own expenses of an audit. If an audit determines
that SAP has breached its obligations under the DPA, SAP will promptly remedy the breach at its own cost.
6.3. Audit by other Controller
Any other Controller may assume Customer's audit rights under this Section 6 only if they apply directly to the
Controller and such audit is permitted and coordinated by Customer. Customer shall use all reasonable means
to combine audits of other Controllers authorized to use SAP Services by the Customer to avoid multiple
audits.
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 4 of 10
7. SUBPROCESSORS
7.1. Permitted Use
SAP is granted a general authorization to subcontract the processing of Personal Data to Subprocessors,
provided that:
(a) SAP or SAP SE on its behalf shall engage Subprocessors under a written (including in electronic form)
contract consistent with the terms of this DPA in relation to the Subprocessor's processing of Personal
Data. SAP shall be liable for any breaches by the Subprocessor in accordance with the terms of the
Agreement;
(b) SAP will evaluate the security, privacy and confidentiality practices of a Subprocessor prior to its selection
in order to establish that it is capable of providing the level of protection of Personal Data required by this
DPA; and
(c) SAP provides to Customer the List of Subprocessors by publishing it on My Trust Center or by making it
available to Customer in writing (email permitted) upon Customer's written request.
7.2. New Subprocessors
SAP's use of Subprocessors is at its discretion, provided that:
(a) SAP will inform Customer in advance by email or posting on My Trust Center of any intended additions
or replacements to the List of Subprocessors. Such advance notification shall be at least 30 calendar
days in respect to Cloud Services and SAP Support and 5 business days in respect to Professional
Services (the "Notification Period"). Customer shall register on My Trust Center and subscribe to its
applicable and available List of Subprocessors.
(b) Customer may object to a new Subprocessor by notifying SAP in writing during the Notification Period
explaining the reasonable ground(s) for its objection. SAP shall not use a new Subprocessor before the
expiration of the Notification Period. If SAP does not receive any objection from Customer during the
Notification Period, Customer is deemed to have accepted the new Subprocessor.
(c) If Customer objects SAP may choose: (i) not to use the Subprocessor; (ii) to take reasonable measures
to remedy Customer's grounds for its objection and use the Subprocessor; or (iii) if the foregoing options
are not possible, use the Subprocessor. If Customer continues to have a legitimate objection, Customer
may terminate the affected SAP Service using the new Subprocessor (provided, however, termination of
SAP Support for software shall also comply with the termination provision of the respective SAP Support
agreement). Termination shall take effect at any time during the term of the Agreement determined by
Customer in its written termination notice provided Customer accepts the use of the proposed
Subprocessor until the effective termination date.
(d) If Customer objects but neither of the options under 7.2.(c) (i) or (ii) are pursued and SAP has not received
notice of termination, Customer is deemed to have accepted the new Subprocessor.
(e) Any termination under this Section shall be deemed to be without fault by either party and shall be subject
to the terms of the Agreement.
7.3. Emergency Replacement
Where a prompt replacement is required for security or other similar urgent reasons and the reason for the
change is outside of SAP’s reasonable control, a Subprocessor may be replaced without advance notice by
SAP. In this case, SAP will inform Customer of the replacement Subprocessor as soon as possible following
its appointment. Section 7.2 will apply accordingly.
8. INTERNATIONAL PROCESSING
8.1. Conditions for International Processing
SAP shall be entitled to process Personal Data, including by using Subprocessors, in accordance with this
DPA, outside the country in which the Customer is located as permitted under Data Protection Law.
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 5 of 10
8.2. EU Standard Contractual Clauses
Sections 8.3 to 8.4 apply where there is a transfer to a Third Country of Personal Data that is either subject to
GDPR or to other Data Protection Law and where any required adequacy means under GDPR or other Data
Protection Law can be met by entering into the EU Standard Contractual Clauses, as amended in accordance
with Data Protection Law.
8.3. Applicability of EU Standard Contractual Clauses Where SAP is Not Located in a Third Country
Where SAP is not located in a Third Country and acts as a data exporter, SAP (or SAP SE on its behalf) has
entered into the EU Standard Contractual Clauses with each Third Country Subprocessor as the data importer.
Module 3 (Processor to Processor) of the EU Standard Contractual Clauses shall apply to such transfers.
8.4. Applicability of EU Standard Contractual Clauses where SAP is Located in a Third Country
8.4.1. Where SAP is located in a Third Country, or a country that otherwise requires use of the EU Standard
Contractual Clauses, SAP and Customer enter into the EU Standard Contractual Clauses with Customer as
the data exporter and SAP as the data importer as follows:
(a) Module 2 (Controller to Processor) shall apply where Customer is a Controller; and
(b) Module 3 (Processor to Processor) shall apply where Customer is a Processor. Where Customer
acts as Processor under Module 3 (Processor to Processor) of the EU Standard Contractual Clauses,
SAP acknowledges that Customer acts as Processor under the instructions of its Controller(s).
Other Controllers or Processors whose use of SAP Services is authorized by Customer under the Agreement
may also enter into the EU Standard Contractual Clauses with SAP in the same manner as Customer in
accordance with Section 8.4.1 above. In such case, Customer enters into the EU Standard Contractual
Clauses on behalf of other Controllers or Processors.
8.4.2. Where Customer is located in a Third Country and is acting as a Processor under Module 2 or Module 3 of
the EU Standard Contractual Clauses and SAP is acting as Customer's sub-processor, the respective data
exporter shall have the following third party beneficiary right:
In the event that Customer has factually disappeared, ceased to exist in law or has become insolvent (in all
cases without a successor entity that has assumed the legal obligations of the Customer by contract or by
operation of law), the respective data exporter shall have the right to terminate the affected SAP Service solely
to the extent that the data exporter's Personal Data is processed. In such event, the respective data exporter
also instructs SAP to erase or return the Personal Data.
8.4.3. On request from a Data Subject, Customer may make a copy of Module 2 or 3 of the EU Standard Contractual
Clauses entered into between Customer and SAP (including the relevant Schedules attached hereto),
available to Data Subjects.
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 6 of 10
Schedule 1 Description of the Processing
This Schedule 1 applies to the Processing of Personal Data under the Agreement and for the purposes of the EU
Standard Contractual Clauses and Data Protection Law.
Where Customer and SAP enter into the EU Standard Contractual Clauses, Schedule 1 is incorporated as Annex I of
the EU Standard Contractual Clauses.
1. OPTIONAL CLAUSES OF THE EU STANDARD CONTRACTUAL CLAUSES
1.1. The governing law of the EU Standard Contractual Clauses shall be the law of Germany and German courts
shall have jurisdiction over any disputes resulting from the EU Standard Contractual Clauses.
1.2. The optional Clause 7 and the option in Clause 11a of the EU Standard Contractual Clauses shall not apply.
1.3. Option 2, General Written Authorization of Clause 9 of the EU Standard Contractual Clauses shall apply in
accordance with the notification periods set out in Section 7 of this DPA.
2. A. LIST OF PARTIES
2.1. Under the EU Standard Contractual Clauses (Section 8.4 of the DPA)
2.1.1. Module 2: Transfer Controller to Processor
Where Customer is the Controller and SAP is the Processor, then Customer is the data exporter and SAP is
the data importer.
2.1.2. Module 3: Transfer Processor to Processor
Where Customer is a Processor and SAP is a Processor, then Customer is the data exporter and SAP is the
data importer.
3. B. DESCRIPTION OF TRANSFER AND PROCESSING
3.1. Categories of Data Subjects Whose Personal Data is Ttransferred or Processed:
Unless provided otherwise by the data exporter, Personal Data relates to the following categories of Data
Subjects: employees, contractors, Business Partners or other individuals having Personal Data stored,
transmitted to, made available to, accessed or otherwise processed by the data importer.
3.2. Categories of Personal Data that are Transferred or Processed:
Customer determines the categories of data and/or data fields which could be transferred or processed per
SAP Service as stated in the Agreement. For Cloud Services, Customer can configure the data fields during
implementation of the Cloud Service or as otherwise provided by the Cloud Service. Personal Data typically
relates to the following categories of data: name, phone numbers, e-mail address, address data, system
access / usage / authorization data, company name, contract data, invoice data, plus any application-specific
data transferred or entered into the SAP Service by Authorized Users and may include financial data such as
bank account data, credit or debit card data.
3.3. Special Data Categories (if agreed)
3.3.1. The transferred Personal Data may comprise special categories of personal data set out in the Agreement
("Sensitive Data"). SAP has applied the Technical and Organizational Measures set out in Schedule 2 to
ensure a level of security appropriate to protect Sensitive Data.
3.3.2. Transfer of Sensitive Data may trigger the application of the following additional restrictions or safeguards if
necessary to take into consideration the nature of the data and the risk of varying likelihood and severity for
the rights and freedoms of natural persons (if applicable):
(a) training of personnel;
(b) encryption of data in transit and at rest; and
(c) system access logging and general data access logging.
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 7 of 10
3.3.3. In addition, the Cloud Services provide measures for handling of Sensitive Data as described in the
Documentation.
3.4. Purposes of Data Transfer and Further Processing; Nature of Processing
3.4.1. For Cloud Services
Personal Data is subject to the following basic Processing activities:
(a) use of Personal Data to set up, operate, monitor, provide and support the Cloud Service (including
operational and technical Support);
(b) continuous improvement of Cloud Service features and functionalities provided as part of the Cloud
Service including automation, transaction processing and machine learning;
(c) provision of Professional Services or Consulting Services;
(d) communication to Authorized Users;
(e) storage of Personal Data in dedicated data centers (multi-tenant architecture);
(f) release, development and upload of any fixes or upgrades to the Cloud Service;
(g) back up and restoration of Personal Data stored in the Cloud Service;
(h) computer processing of Personal Data, including data transmission, data retrieval, data access;
(i) network access to allow Personal Data transfer;
(j) monitoring, troubleshooting and administering the underlying Cloud Service infrastructure and database;
(k) security monitoring, network-based intrusion detection support, penetration testing; and
(l) execution of instructions from Customer in accordance with the Agreement.
The purpose of the transfer and processing is to provide and support the Cloud Service. SAP and its
Subprocessors may support the Cloud Service data centers remotely. SAP and its Subprocessors provide
support when a Customer submits a support ticket as further set out in the Agreement.
3.4.2. For SAP Support and Professional Services:
Personal Data is subject to the basic processing activities as set out in the Agreement which may include:
(a) accessing systems containing Personal Data in order to provide SAP Support and Professional Services;
(b) use of Personal Data to provide and support the SAP Service;
(c) continuous improvement of service features and functionalities provided as part of the SAP Service
including automation, transaction processing and machine learning;
(d) storage of Personal Data;
(e) computer processing of Personal Data for data transmission; and
(f) execution of instructions from Customer in accordance with the Agreement.
3.4.3. For SAP Support:
SAP or its Subprocessors provide support when a Customer submits a support ticket because the software is
not available or not working as expected. SAP or its Subprocessors answer phone calls, perform basic
troubleshooting, and handle support tickets in a tracking system.
3.4.4. For Professional Services:
SAP or its Subprocessors provide Professional Services subject to the Agreement for Professional Services
and the applicable scope document.
3.5. The purpose of the transfer is to provide and support the relevant SAP Service. SAP and its Subprocessors
may provide or support the SAP Service remotely.
3.6. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):
Personal Data will be transferred on an ongoing basis for the duration of the Agreement.
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 8 of 10
3.7. The period for which Personal Data will be retained, or, if that is not possible, the criteria used to determine
that period:
Personal Data will be retained by SAP as set out in Section 5 of the DPA.
3.8. For transfers to (sub-) processors, also specify subject matter, nature and duration of processing:
SAP will transfer Personal Data to Subprocessors as stated in the applicable List of Subprocessors for the
duration of the Agreement.
4. C. COMPETENT SUPERVISORY AUTHORITY
4.1. In respect of the EU Standard Contractual Clauses:
Where Customer is the data exporter under Module 2 or Module 3, the supervisory authority shall be the
competent supervisory authority that has supervision over the Customer in accordance with Clause 13 of the
EU Standard Contractual Clauses.
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 9 of 10
Schedule 2 Technical and Organizational Measures
The Technical and Organizational Measures (as defined in Section 1.16) are hereby incorporated by reference.
These Technical and Organizational Measures also describe the applicable technical and organizational measures for
the purposes of the EU Standard Contractual Clauses and Data Protection Law. Where Customer and SAP enter into
the EU Standard Contractual Clauses, Schedule 2 is incorporated as Annex II of the EU Standard Contractual Clauses.
To the extent that provisioning of SAP Service(s) involves an international transfer to which the EU Standard
Contractual Clauses apply, the Technical and Organizational Measures describe the measures and safeguards that
consider the nature of Personal Data and the risks involved. If local laws affect compliance with EU Standard
Contractual Clauses, additional safeguards may be triggered during the transmission and processing of Personal Data
in the country of destination (if applicable: encryption of data in transit, encryption of data at rest, anonymization,
pseudonymization).
Data Processing Agreement for Cloud Services, SAP Support and SAP Services enGLOBAL.v.10-2024 Page 10 of 10