Art.30 Key contractual provisions
Contracts set out the rights and obligations of both parties in one written document, available on paper or another durable, downloadable format, including the service levels. Every ICT services contract covers at least: the functions and services and whether and how subcontracting is permitted; service and data processing locations, with advance notice of changes; data protection provisions; access, recovery and return of data on insolvency, resolution, discontinuation or termination; service level descriptions; incident assistance at no cost or a cost fixed in advance; cooperation with competent and resolution authorities; termination rights and minimum notice periods; and participation in security awareness training. Contracts for services supporting critical or important functions add: full service levels with quantitative and qualitative targets, notice and reporting duties, provider contingency testing and security measures, participation in the entity's TLPT, unrestricted access, inspection and audit rights for the entity and the authority, and exit strategies with a mandatory transition period (Art. 30(3)). A microenterprise may agree with the provider that its access, inspection and audit rights are handed to an independent party that the provider appoints, from which it can request information and assurance at any time (Art. 30(3), final subparagraph). Standard contractual clauses from public authorities should be considered.
Source: DORA (Regulation (EU) 2022/2554), Art.30. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.
Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- ICT service contracts held as a single written document that includes the service level agreement · Vendor register / contract repository
- Contract clause checklist per contract mapped to the Article 30(2) minimum elements · Vendor register / contract repository
- For critical or important functions: clauses on quantitative service targets, TLPT participation, unrestricted audit and access rights and exit transition periods · Policy repository / GRC workspace
- For a microenterprise using the derogation: the agreement delegating audit rights to an independent party and the assurance reports received · Vendor register / contract repository
First move
Common gaps auditors find
- Contract silent on data location changes or data return on termination
- Critical-function contract lacks a transition period on exit
- Audit rights limited by the provider's standard terms
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.29 Preliminary assessment of ICT concentration risk at entity level · Art.31 Designation of critical ICT third-party service providers