Contractual arrangements document the formal agreements between your financial entity and ICT third-party service providers. Under DORA, these arrangements must be recorded in the Register of Information and meet specific contractual requirements outlined in Article 30.
Contracts List Page
Search and Filters
The contracts list provides a search bar for filtering by contract reference or provider name, and a status filter dropdown with the following options:
- All — show all contracts
- Active — currently in force
- Draft — not yet finalised
- Expiring — end date within 90 days
- Expired — past end date
- Terminated — manually terminated
Table Columns
| Column | Description |
|---|---|
| Reference | The contract reference code (e.g., AWS-2025-001) |
| Provider | The linked ICT provider's display name |
| Type | Contract type from ESA code list |
| Period | Start date to end date range |
| Annual Cost | Annual cost with currency symbol |
| Status | Status badge (see colours below) |
| Functions | Count of linked business functions |
| Actions | View, Edit, Delete buttons |
Status Badge Colours
- Active — green badge
- Draft — gray badge
- Expiring — amber badge
- Expired — red badge
- Terminated — red badge
Creating a Contract
Click "Add Contract" to open the creation form. Complete the following fields:
| Field | Type | Required | Details |
|---|---|---|---|
| ICT Provider | Dropdown | Required | Select from your registered ICT providers. The provider must be created first. |
| Contract Reference | Text input | Required | A unique reference for this arrangement. Placeholder: "AWS-2025-001" |
| Contract Type | Dropdown | Required | Options from ESA code list including: Outsourcing, Licensing, Subscription, Maintenance/Support, Consultancy, Development, Hosting, Cloud Services, Data Services, Network Services, Security Services, Other |
| Start Date | Date picker | Required | The date the contractual arrangement takes effect. |
| End Date | Date picker | Optional | The date the arrangement expires. Leave blank for open-ended contracts. |
| Annual Cost | Number input | Optional | The annual cost of the arrangement. |
| Currency | Dropdown | Optional | Options: EUR, USD, GBP, CHF, BGN |
| ICT Service Type | Dropdown | Optional | The type of ICT service provided. The system can auto-detect the service type based on the provider type and contract type. |
| Parent Arrangement | Dropdown | Optional | Select "None" or another existing contract if this is a sub-arrangement. |
| Service Description | Text input | Optional | A brief description of the ICT services covered by this arrangement. |
| Data Storage Locations (at rest) | Multi-select countries | Optional | Select all countries where data is stored at rest under this arrangement. |
| Data Processing Locations | Multi-select countries | Optional | Select all countries where data is actively processed. |
| Notice Period — Entity | Number input | Optional | Number of days notice required from your entity to terminate. Measured in days. |
| Notice Period — Provider | Number input | Optional | Number of days notice required from the provider to terminate. Measured in days. |
| Governing Law Country | Dropdown | Optional | The country whose law governs this contract. |
| Country of Provision | Dropdown | Optional | The country from which the ICT service is primarily provided. |
| Data Sensitivity | Dropdown | Optional | Options: Low, Medium, High. Indicates the sensitivity level of data handled under this arrangement. |
| Reliance Level | Dropdown | Optional | Options: Low, Medium, High. Indicates how dependent your entity is on this ICT service. |
| Termination Reason | Textarea | Optional | If the contract has been terminated, record the reason here. |
| Notes | Textarea | Optional | Free-text notes about this contractual arrangement. |
Article 30 Clause Checker
DORA Article 30 mandates specific contractual provisions. The clause checker provides 8 checkboxes to track whether each required clause is present in the contract:
| # | Clause | DORA Reference |
|---|---|---|
| 1 | SLA defined | Service level agreements with clear performance targets |
| 2 | Security standards | ICT security requirements and standards specified |
| 3 | Incident reporting | Obligations for ICT incident notification and response |
| 4 | Audit rights | Right to audit or inspect the provider |
| 5 | Termination clauses | Clear termination and exit provisions |
| 6 | Data location | Specification of data storage and processing locations |
| 7 | Subcontracting notification | Provider must notify of sub-outsourcing arrangements |
| 8 | Exit strategy | Transition and exit strategy defined |
Contracts supporting critical or important functions must include all eight clauses under DORA Art 30. Missing clauses will be flagged in the pre-export validation as errors.
Editing a Contract
The edit page includes all the fields from the creation form, plus the following additional features:
Status Dropdown
When editing, you can change the contract status via a dropdown selector. Options: Active, Draft, Expiring, Expired, Terminated.
Document Upload
You can attach supporting documents to a contract. The document upload section supports the following file types:
- PDF, DOCX, XLSX, CSV, TXT, PNG, JPG, JPEG
Each uploaded document displays:
- Filename — the original file name
- Size — file size in KB or MB
- Upload date — when the document was attached
- Download button — to retrieve the document
- Delete button — to remove the attachment
Link your contracts to business functions to build the full dependency chain required for ESA templates B_04.01 and B_06.01. This also feeds into the concentration risk analysis.