Knowledge · DORA · Article 30
What every ICT contract must say.
Contracts with ICT third-party service providers must be in writing and contain specific provisions – and contracts supporting critical or important functions must contain more.
DORA art. 30Key contractual provisions
What it requires
In plain words.
- A clear description of all functions and services
- Where the services are provided and where data is processed
- Availability, authenticity, integrity and confidentiality of data
- Access, recovery and return of data if the provider fails or the contract ends
- Service level descriptions
- Assistance with ICT incidents at no extra or at pre-agreed cost
- Cooperation with competent authorities
- Termination rights and minimum notice periods
- For critical or important functions: precise service levels, contingency plans, audit and access rights, and exit with a transition period
Plain-language summary of DORA Article 30 (Regulation (EU) 2022/2554). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
Most gaps are found in older agreements signed before DORA. The fastest way through is to check every ICT contract against the list and amend from approved clauses.
- Contract requirementsEach provision as a requirement, checked clause by clause
- GapsAgreements missing a provision, with owner and due date
- Clause LibraryApproved DORA clauses for amendments and new contracts
- EvidenceThe signed amendment linked back to the requirement
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See DORA article 30
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.