DATEV
Accounting · datev.de · last read 2026-11-09
At a glance
- Is DATEV GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what DATEV itself publishes, each answer linked to its source and the date we read it.
- Does DATEV have a data processing agreement (DPA)?
- Yes. DATEV publishes a data processing agreement at datev.de. It describes how a new subprocessor is announced but states no notice period. We recorded no breach-notification deadline in it. Source and date
- Is DATEV ISO 27001 certified?
- DATEV states ISO/IEC 27001 certification, and its own page links to the certificate. In DATEV's words (in German): “Das DATEV Informationssicherheitsmanagementsystem wurde nach ISO 27001 zertifiziert.” We read this on 2026-10-25. Source and date
- How does DATEV transfer personal data out of the EU?
- We found no entry for DATEV on the official Data Privacy Framework List. Source and date
- How do you report a security vulnerability to DATEV?
- DATEV publishes a security.txt at www.datev.de naming [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | DATEV eG |
|---|---|
| HQ | DE |
| Parent company | — |
| Ultimate ownership | DE |
| EU contracting entity | — |
| LEI | 529900MSG2MGANMD7Q29 |
| US CLOUD Act reach | No US company in the ownership chain on record |
| Source | datev.de · 2026-10-25 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
No data-location observation recorded yet.
The same question for every vendor: where SaaS vendors store EU data.
Subprocessor chain
Processing terms
From the vendor's data processing agreement · read 2026-10-25 · datev.de
| Term | What the agreement says |
|---|---|
| Notice of new subprocessors | DATEV informs the customer of intended addition or replacement of subprocessors; changes viewable product-specifically in Help Center document no. 1000192 / www.datev.de/hilfe/1000192; no notice period stated |
| If you object to one | Customer may object within 4 weeks of receiving notice; DATEV may then either provide the service without the change or, if that is unreasonable for DATEV, terminate the affected service within 4 weeks of receiving the objection |
| Obligations passed to subprocessors | DATEV passes its data protection obligations under this agreement on to any further processor it engages |
| Deletion when the service ends | After the end of processing services, at customer's choice deletes all personal data or returns it, unless EU or German law requires storage or the service descriptions/contracts provide otherwise; no period stated |
| Getting your data back | After the end of processing services, at customer's choice returns all personal data to the customer (or deletes it), unless EU or German law requires storage; no period stated |
| Requests from data subjects | Supports the customer, where possible, with appropriate technical and organisational measures in answering data subject rights requests (GDPR Chapter III); may charge reasonable fee; no handling of requests sent directly to DATEV specified |
| Audit | Compliance shown primarily through independent audit reports and certifications; on-site spot checks if justified doubts or incidents (and also without cause), with written notice of at least 14 calendar days; confidentiality undertaking may be required; DATEV may charge reasonable fee |
| Audit | DATEV may charge the customer reasonable compensation for inspections |
| Processing on your instructions | Processes personal data only within the service descriptions, the contractual agreements and the customer's instructions, except where Art. 28(3)(a) GDPR allows otherwise; instructions accepted in writing or electronic formats |
| Confidentiality of staff | Authorised persons have committed to confidentiality or are under an appropriate statutory duty of secrecy |
| Security measures | Takes all measures required under Art. 32 GDPR; current technical and organisational measures published in help document no. 1000562 (www.datev.de/hilfe/1000562) |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Is DATEV ISO 27001 certified?
DATEV states ISO/IEC 27001 certification, and its own page links to the certificate. We read this on 2026-10-25.
- Certificate published “Das DATEV Informationssicherheitsmanagementsystem wurde nach ISO 27001 zertifiziert.” (in German)
Source: datev.de, 2026-10-25
On the same list DATEV also names ISO/IEC 27017 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| ISO 27001 · ISO27001 | Certificate published | DATEV Informationssicherheitsmanagementsystem | datev.de | 2026-10-25 |
| ISO/IEC 27017 · ISO27017 | Certificate published | Informationssicherheit für Cloud Dienste (Erweiterung des ISMS nach ISO 27001) | datev.de | 2026-10-25 |
| ISO 27701 · ISO27701 | Certificate published | DATEV Datenschutzmanagementsystem | datev.de | 2026-10-25 |
| ISO 9001 · ISO9001 | Certificate published | Qualitätsmanagement | datev.de | 2026-10-25 |
| DIN EN 50518 | Certificate published | Alarmempfangsstellen (Paumgartner Straße, Virnsberger Straße) | datev.de | 2026-10-25 |
| ETSI | Certificate published | Zertifizierungsdienste STD, ITN und BT CAs | datev.de | 2026-10-25 |
| ISO 20000 | Certificate published | Servicemanagement | datev.de | 2026-10-25 |
| ISO 21964 | Certificate published | Vernichtung von Datenträgern bei DATEV (Schutzklasse 3 und Sicherheitsstufe P4, O3, H5, E4) | datev.de | 2026-10-25 |
| ISO14001 | Certificate published | Umweltmanagementsystem | datev.de | 2026-10-25 |
| ISO5001 | Certificate published | — | datev.de | 2026-10-25 |
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Global LEI Index (GLEIF) | DATEV eG · DATEV eG | ISSUED | DE | 2027-01-25 | 2026-10-25 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under DATEV; DATEV eG
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under DATEV; DATEV eG
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under DATEV; DATEV eG
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under DATEV; DATEV eG
- Data Privacy Framework List (US): checked 2026-11-09, no entry under DATEV; DATEV eG
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under DATEV; DATEV eG
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under DATEV; DATEV eG
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under DATEV; DATEV eG
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under DATEV; DATEV eG
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under DATEV; DATEV eG
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2027-04-30; read 2026-10-25)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-25 |
| dpa | Public | full | 200 | 2026-10-25 |
| identity | Public | full | 200 | 2026-10-25 |
History
Nothing has moved since we started watching this vendor on 2026-10-25. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.