DORA Contract Requirements: Article 30 Clause Checklist for ICT Providers
DORA tells financial entities exactly what their contracts with ICT providers must say. If you are a financial firm, this is your contract review checklist. If you sell ICT services to one, this is what your customer's lawyers will ask for.
The basics
Article 30(1) of DORA (Regulation (EU) 2022/2554) requires the rights and obligations of both parties to be clearly allocated and set out in writing. The full contract, including the service level agreements, must be documented in one written document, available on paper or in another downloadable, durable and accessible format.
Article 30(2) applies to every contract for ICT services. Article 30(3) adds further clauses where the services support critical or important functions. When negotiating, both parties must consider standard contractual clauses developed by public authorities for specific services (Article 30(4)).
Clauses every ICT contract needs (Article 30(2))
| Clause | Article |
|---|---|
| A clear and complete description of all functions and ICT services, stating whether subcontracting of a service supporting a critical or important function is permitted and under which conditions | 30(2)(a) |
| The regions or countries where services are provided and data is processed and stored, and a duty to notify you in advance of any change of location | 30(2)(b) |
| Provisions on the availability, authenticity, integrity and confidentiality of data, including personal data | 30(2)(c) |
| Access, recovery and return of data in an easily accessible format on the provider's insolvency, resolution or discontinuation, or on termination | 30(2)(d) |
| Service level descriptions, including updates and revisions | 30(2)(e) |
| Assistance when an ICT incident related to the service occurs, at no additional cost or at a cost determined in advance | 30(2)(f) |
| Full cooperation with the competent authorities and resolution authorities, including persons they appoint | 30(2)(g) |
| Termination rights and minimum notice periods, in line with the authorities' expectations | 30(2)(h) |
| Conditions for the provider's participation in your ICT security awareness and resilience training | 30(2)(i) |
Extra clauses for critical or important functions (Article 30(3))
| Clause | Article |
|---|---|
| Full service level descriptions with precise quantitative and qualitative performance targets, so you can monitor and act without undue delay when levels are not met | 30(3)(a) |
| Notice periods and reporting obligations, including notice of any development that might materially affect the provider's ability to deliver | 30(3)(b) |
| The provider implements and tests business contingency plans and has appropriate ICT security measures, tools and policies | 30(3)(c) |
| The provider participates and fully cooperates in your threat-led penetration testing (TLPT) | 30(3)(d) |
| Ongoing monitoring rights: unrestricted access, inspection and audit for you, an appointed third party and the competent authority, including copies of documentation; alternative assurance levels where other clients' rights are affected; full cooperation during inspections; details of scope, procedures and frequency | 30(3)(e) |
| Exit strategies with a mandatory adequate transition period, during which the provider keeps delivering while you migrate to another provider or in-house | 30(3)(f) |
For microenterprises, the provider and the financial entity may agree that access, inspection and audit rights are delegated to an independent third party appointed by the provider, as long as the financial entity can request information and assurance from that third party at any time (Article 30(3), last subparagraph).
Termination rights (Article 28(7))
Separately, Article 28(7) requires that every ICT contract can be terminated in at least these cases:
- a significant breach by the provider of applicable laws, regulations or contractual terms;
- circumstances identified through monitoring that could alter the performance of the functions, including material changes affecting the arrangement or the provider;
- evidenced weaknesses in the provider's overall ICT risk management, in particular in protecting data;
- the competent authority can no longer effectively supervise the financial entity because of the arrangement.
Subcontracting: Delegated Regulation (EU) 2025/532
Where subcontracting of ICT services supporting critical or important functions is allowed, Delegated Regulation (EU) 2025/532 sets the conditions. Before contracting, you decide whether subcontracting is allowed and assess the risks (Article 3). The contract must then, among other things (Article 4):
- identify which services may be subcontracted and under which conditions;
- make the provider responsible for the services its subcontractors provide, and require it to monitor them;
- set the provider's monitoring and reporting duties towards you regarding subcontractors;
- require the provider to assess the risks of the subcontractors' locations and to ensure continuity through the whole chain;
- pass contingency-plan, service-level and security requirements down to the subcontractors.
The provider must inform you of intended material changes to its subcontracting well in time, within a notice period during which you can approve or object, and may only implement them after you have approved or not objected (Article 5). You can provide in the contract for termination if the provider implements changes you objected to, or implements them before the notice period ends without your approval (Article 6).
Before you sign
Article 28(4) requires you, before entering into the contract, to assess whether it covers a critical or important function, check supervisory conditions, identify and assess the risks including concentration risk, carry out due diligence on the provider, and identify conflicts of interest. Record the outcome; it also feeds your register of information.
Assess the provider: the free Vendor Risk Assessment gives you a structured due diligence record, and the DORA Compliance Checker covers third-party risk alongside the other pillars.
Clauses ready to attach. The Vendor Security Assessment Pack includes a vendor security requirements addendum with a DORA Article 30 clause, a vendor exit plan template, a security questionnaire, an onboarding checklist, a risk register and a data processing agreement.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 28 and 30, EUR-Lex
- Commission Delegated Regulation (EU) 2025/532: subcontracting ICT services supporting critical or important functions, EUR-Lex
Related tools
Further reading: DORA Compliance Checklist · DORA Register of Information
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.