Common use of Customer Audit Clause in Contracts

Customer Audit. Customer or its independent third party auditor reasonably acceptable to SAP (which shall not include any third party auditors who are either a competitor of SAP or not suitably qualified or independent) may audit SAP’s control environment and security practices relevant to Personal Data processed by SAP only if: (a) SAP has not provided sufficient evidence of its compliance with the technical and organizational measures that protect the production systems of the Cloud Service through providing either: (i) a certification as to compliance with ISO 27001 or other standards (scope as defined in the certificate); or (ii) a valid ISAE3402 and/or ISAE3000 or other SOC1-3 attestation report. Upon Customer’s request audit reports or ISO certifications are available through the third party auditor or SAP; (b) A Personal Data Breach has occurred; (c) An audit is formally requested by Customer’s data protection authority; or (d) Mandatory Data Protection Law provides Customer with a direct audit right and provided that Customer shall only audit once in any twelve month period unless mandatory Data Protection Law requires more frequent audits.

Customer Audit. Customer or its independent third third-party auditor reasonably acceptable to SAP RA (which shall not include any third third-party auditors who are either a competitor of SAP RA or not suitably qualified or independent) may audit SAPRA’s control environment and security practices relevant to Personal Data processed by SAP RA only if: (a) SAP RA has not provided sufficient evidence of its compliance with the technical and organizational measures that protect the production systems of the Cloud Service through providing either: : (i) a certification as to compliance with ISO 27001 or other standards (scope as defined in the certificate); or (ii) a valid ISAE3402 and/or ISAE3000 or other SOC1-3 attestation report. Upon Customer’s request audit reports or ISO certifications are available through the third third- party auditor or SAPRA; (b) A Personal Data Breach has occurred; (c) An audit is formally requested by Customer’s data protection authority; or (d) Mandatory Data Protection Law provides Customer with a direct audit right and provided that Customer shall only audit once in any twelve (12) month period unless mandatory Data Protection Law requires more frequent audits.