Ist ein Auftragsverarbeitungsvertrag (AVV) nach DSGVO erforderlich?

Jul 21, 2026

Many companies are faced with the question of whether they must enter into a data processing agreement (DPA) with their tax advisor in accordance with Article 28 of the GDPR—particularly with regard to payroll processing.


There is considerable uncertainty, as data protection authorities and supervisory bodies have held differing views on this matter since the introduction of the GDPR. However, the legislature provided clarity on this issue with the amendment to Section 11 of the Tax Advisors Act (StBerG) on December 18, 2019, thereby confirming the legal opinion of the Federal Chamber of Tax Advisors.


As a general rule, data processing on behalf of a controller only occurs if the service provider acts under the controller’s instructions (Art. 28(3) GDPR).


However, tax advisors regularly act on their own responsibility and without being bound by instructions, in accordance with the Tax Advisory Act (Section 57 StBerG). Tax advisors are subject to professional confidentiality obligations under the StBerG as well as to confidentiality requirements protected by criminal law under Section 203 of the German Criminal Code (StGB).


The revised Section 11(2) of the Tax Advisors Act (StBerG), as amended, clarifies that the tax advisor clearly acts as an independent controller within the meaning of Article 4(7) of the GDPR. Therefore, even when handling payroll processing, this does not constitute processing on behalf of another controller within the meaning of Article 28 of the GDPR, as these services are also professional services performed under the tax advisor’s own responsibility.


For companies, this means that a data processing agreement with the tax advisor is not required. Instead, the tax advisor processes personal data as an independent controller within the meaning of Article 4(7) of the GDPR. The respective processing is based on the relevant legal grounds set forth in Article 6 of the GDPR and Section 11 of the StBerG, as amended.


HCSM helps you resolve tax and data protection issues in a practical and legally sound manner.


Note: This article is for general informational purposes only and does not constitute individual tax advice.