DORA Article 30: the 15 clauses your ICT contracts must include

The 15 clauses at a glance

Each row links to the detail below. The article reference is the point of Regulation (EU) 2022/2554 the clause comes from, so you can check the wording yourself.

Before the clauses: one written document

Article 30(1) requires the rights and obligations of both parties to be clearly allocated and set out in writing. The full contract, including the service level agreements, must be documented in one written document, available on paper or in another downloadable, durable and accessible format. A master agreement that points to SLAs on a supplier web page that can change without notice does not meet this. Neither does a set of order forms with no single place that sets out the terms. Article 30(4) also asks both sides to consider standard contractual clauses developed by public authorities for specific services, where they exist.

Clauses 1 to 9: required in every ICT contract

These apply to every contractual arrangement for ICT services, from core banking software to a print management tool. Article 30(2) calls them the minimum.

1. A full description of the services and the subcontracting conditions

The contract must give a clear and complete description of every function and ICT service the provider delivers. It must also say whether the provider may subcontract an ICT service that supports a critical or important function, or material parts of one, and if so on what conditions. A schedule that reads "managed IT services as agreed" falls short. Name the services, the systems they cover and the support hours. Where subcontracting is allowed, the conditions now come from Delegated Regulation (EU) 2025/532, which we cover below.

2. Where the service is delivered and the data is held

The contract must name the regions or countries where the provider and its subcontractors deliver the service and process data, including where the data is stored. The provider must also tell you in advance if it plans to change those locations. For a cloud service, that means the hosting regions and the countries the support staff work from, because remote administration is processing too. Ask for a notice period long enough for you to assess the change and, if needed, object to it.

3. Protection of data, including personal data

The contract needs provisions on the availability, authenticity, integrity and confidentiality of data, including personal data. Your GDPR Article 28 data processing agreement still applies alongside it. In practice this means concrete security commitments in the contract body or a security schedule: encryption, access control, backup, and how the provider will show you it does these things.

4. Access to and return of your data

If the provider becomes insolvent, enters resolution or stops trading, or if the contract ends, you must be able to access, recover and get back your personal and non-personal data in an easily accessible format. Write down the format (a database export, CSV files, a standard backup format), the timescale and who pays. An export that only the provider's own software can read is hard to call easily accessible.

5. Service level descriptions

Every ICT contract needs service level descriptions, including how they are updated and revised. For services that do not support a critical or important function, a description is enough. Clause 10 sets a much higher bar for the rest.

6. Help during ICT incidents at no extra cost or a cost agreed in advance

When an ICT incident related to the service occurs, the provider must help you, either at no additional cost or at a cost determined in advance. You will need that help to meet DORA's reporting deadlines: for a major incident, the initial notification to your competent authority is due within 4 hours of classifying it as major and no later than 24 hours after you became aware of it. Agree a rate card or a fixed allowance for incident support now, so nobody is negotiating prices during an outage.

7. Full cooperation with competent and resolution authorities

The provider must cooperate fully with your competent authorities and resolution authorities, including people they appoint. Some suppliers resist this clause because it gives a party they have no contract with rights over them. It cannot be traded away: a contract without it does not comply.

8. Termination rights and minimum notice periods

The contract must set termination rights and minimum notice periods that meet the expectations of your competent and resolution authorities. Article 28(7) lists four situations in which you must be able to terminate:

• a significant breach by the provider of applicable law, regulation or the contract
• circumstances found through monitoring that could change how the contracted service performs, including material changes affecting the provider
• evidenced weaknesses in the provider's overall ICT risk management, in particular in how it protects the availability, authenticity, integrity and confidentiality of data
• conditions of the arrangement that stop your competent authority from supervising you effectively

Check that the termination clause covers all four, and that the notice period works with the exit plan in clause 15.

9. Participation in security awareness and resilience training

The contract must set the conditions for the provider's staff to take part in your ICT security awareness programmes and digital operational resilience training, as Article 13(6) requires. For an outsourced service desk or a managed security provider, whose staff work in your systems every day, this clause has real weight. Agree which provider staff take part, how often, and how attendance is recorded.

Clauses 10 to 15: added for critical or important functions

Article 30(3) adds six clauses when the ICT service supports a critical or important function. DORA defines that, in Article 3(22), as a function whose disruption would materially impair your financial performance or the soundness or continuity of your services, or whose failure would materially impair your compliance with the conditions of your authorisation. You decide which functions meet that test, and you need to document why.

10. Full SLAs with precise performance targets

Service level descriptions become full service level agreements with precise quantitative and qualitative performance targets. The targets must let you monitor the service effectively and take corrective action without undue delay when the provider misses them. Availability percentages, response and resolution times by priority, recovery time and recovery point objectives and a reporting schedule all belong here, together with what happens when a target is missed.

11. Notice periods and reporting obligations

The provider must give you notice of, and report on, any development that might materially affect its ability to deliver the service at the agreed service levels. A change of ownership, the loss of a key subcontractor, a serious incident at the provider that affects other clients, or financial difficulty would all qualify. Put a timescale on each.

12. Tested business contingency plans and ICT security measures

The provider must implement and test business contingency plans, and have ICT security measures, tools and policies that give an appropriate level of security in line with your regulatory framework. Ask to see the test results as well as the plan. A contingency plan that has never been exercised tells you very little about what happens on the day.

13. Participation in threat-led penetration testing

The provider must take part and cooperate fully in your threat-led penetration testing (TLPT) under Articles 26 and 27. TLPT is only required of financial entities that their competent authority identifies, but this clause belongs in every contract for a critical or important service. Cloud and shared-service providers often prefer pooled testing, where one tester works across several clients under the direction of one designated financial entity, which Article 26(4) allows.

14. Unrestricted rights of access, inspection and audit

You need the right to monitor the provider's performance on an ongoing basis. Article 30(3)(e) breaks that right into four parts:

• unrestricted rights of access, inspection and audit for you, a third party you appoint and your competent authority, including the right to take copies of relevant documents on site, which no other contract term or policy may limit
• the right to agree alternative assurance levels if other clients' rights are affected
• the provider's duty to cooperate fully during on-site inspections and audits by the competent authorities, the Lead Overseer, you or your appointed third party
• details of the scope, procedures and frequency of those inspections and audits

"Unrestricted" is the word suppliers most often try to soften. Pooled audits and reports such as ISO 27001 certificates or SOC 2 reports help with ongoing monitoring, and they are a reasonable way to agree alternative assurance, but the contractual right must still be there. Microenterprises have one concession: they may agree that an independent third party appointed by the provider carries out the audits, as long as the microenterprise can ask that third party for information and assurance at any time.

15. An exit strategy with a mandatory transition period

The contract must provide for exit, in particular a mandatory adequate transition period. During it, the provider keeps delivering the service, to reduce the risk of disruption or to support your resolution and restructuring, while you migrate to another provider or bring the service in-house. Article 28(8) separately requires you to have documented, tested and periodically reviewed exit plans for these services. The contract clause is what makes those plans possible to carry out. DORA does not fix the length of the transition period, so set it by how long a migration of that service would realistically take, and link it to the data return terms in clause 4.

Subcontracting: the rules in force since July 2025

Clause 1 asks whether a critical or important service may be subcontracted. Commission Delegated Regulation (EU) 2025/532, published on 2 July 2025 and in force since 22 July 2025, sets out what you must assess and agree when it is. The contract must identify which services may be subcontracted and require the provider to tell you in advance about material changes to its subcontracting, such as adding, replacing or relocating a subcontractor that supports the service. You must be able to object to a material change and to terminate if the resulting risk is more than you can accept. Monitoring, reporting and audit rights also need to reach down the subcontracting chain. Review existing contracts against it as well as new ones.

If you are the ICT supplier

DORA puts the obligation on the financial entity, but the clauses bind the supplier once signed. If you sell IT, cloud, software or managed security services to banks, insurers, payment or e-money institutions, investment firms or crypto-asset service providers in the EU, expect a DORA addendum at your next renewal if you have not had one already. Read three parts closely: the audit procedures under clause 14 (scope, notice and who pays for an audit), the cost model for incident assistance under clause 6, and the transition period under clause 15, which can commit you to running a service after the contract has ended. Providers that the European Supervisory Authorities designate as critical also face direct oversight by a Lead Overseer. That is a separate regime from these contract terms.

What it means for UK firms

DORA does not apply to firms authorised only in the UK. It reaches UK groups through their EU-authorised entities, and UK ICT providers through their EU financial services customers. UK firms work under their own outsourcing rules, PRA Supervisory Statement SS2/21 and the FCA's SYSC 8, and from 18 March 2027 the FCA and PRA third-party reporting rules in PS26/2. The two regimes overlap a great deal. A contract written to meet Article 30 will cover most of what SS2/21 expects, but check the UK requirements separately. Our list of compliance deadlines in 2027 covers the March 2027 date.

How to review your contracts

Start from your register of information. It already lists your ICT contracts and marks the ones that support critical or important functions. Check those against all fifteen clauses and the rest against the first nine. Record each gap with an owner, then close it with an addendum or at renewal, starting with the contracts where a gap would hurt most: core banking and payments, cloud hosting, and outsourced security monitoring. Our DORA gap analysis guide covers the wider process, and our article on DORA for financial services covers the other four pillars.