DORA, Regulation (EU) 2022/2554, applies from 17 January 2025. Article 30 sets key contractual provisions for ICT services: a baseline list for all contracts, and extra terms where the service supports a critical or important function. This is education, not legal advice.
Baseline for every ICT contract
Under Article 30(1) and (2), rights and obligations must be set out in writing, with the full contract in one document, including service levels, available on paper or in a durable, downloadable format. Paragraph 2 lists minimum elements:
- a full description of the services, and whether subcontracting is allowed and on what conditions
- the locations where services are provided and data is processed, with advance notice of changes
- safeguards for availability, authenticity, integrity and confidentiality of data
- access to and return of data if the provider becomes insolvent or the contract ends
- service level descriptions and assistance during incidents
- full cooperation with competent and resolution authorities
- termination rights and notice periods
- provider participation in security awareness and resilience training
Extra terms for critical or important functions
Article 30(3) adds for those services:
- precise quantitative and qualitative performance targets
- notice and reporting obligations
- business continuity testing and security requirements
- participation in threat led penetration testing under Articles 26 and 27
- ongoing monitoring rights, including access, inspection and audit rights
- exit strategies with a mandatory transition period
Where engineering input is needed
Procurement and legal draft the clauses. Engineers know whether they are workable.
Data location and subcontracting. Do you know where your provider processes data and who their subprocessors are? If not, the clause cannot be checked.
Data return. Can you actually export your data in a usable format? Test it before you sign, not at exit.
Exit. A transition period only helps if you can run the service elsewhere. Document dependencies and a realistic migration plan.
Audit and inspection. Decide what evidence you would request and how often. Contract rights you never use are weak assurance.
Incident assistance. Define what the provider must supply during an incident, such as logs, within what time.
What goes wrong in practice
Teams often discover at exit that the data format is proprietary, that a subcontractor held the data, or that the audit right needs a notice period nobody planned for. Each of these maps to a clause in the lists above. Catching them at signature costs a negotiation. Catching them at exit costs a migration.
A simple process
- Inventory ICT providers and tag which support critical or important functions.
- For each, compare the contract to the lists above and mark gaps.
- Prioritise gaps on tagged providers.
- Record the decision for any gap you accept.
The recitals say contracts should describe functions and data locations in full and support exit strategies, so use them as context when interpreting the Article.
Quick check
Does Article 30(3) apply to all providers?
No. It adds terms for ICT services supporting critical or important functions. Paragraph 2 applies to all ICT service contracts.
When does DORA apply?
From 17 January 2025, per the Regulation's text.
Sources
Last reviewed: 19 October 2026.
