Contract remediation: repapering for DORA, IBOR and data protection

Short answer: Contract remediation, or repapering, means bringing an entire contract portfolio into line with new requirements. Typical triggers are the minimum terms for ICT contracts under Article 30 DORA, fallback provisions for benchmark rates under Article 28(2) of the Benchmarks Regulation and data processing agreements under Article 28 GDPR. Successful projects build the inventory and a clause standard first and negotiate only afterwards.

This guide is for general counsel, heads of legal, legal operations leads and heads of compliance in Switzerland and Germany. It explains the main triggers and their legal basis, sets out a six-step approach and helps you plan team and effort realistically.

What contract remediation is

Contract remediation is a project in which a large number of existing contracts are reviewed against one set of criteria and then amended, supplemented or re-signed. Unlike day-to-day contract review, it deals with the legacy portfolio rather than new deals.

• A volume project with a legal core: hundreds or thousands of contracts follow the same review grid; only deviations need a legal decision.
• Standardise before you negotiate: a clause standard and an amendment template save more time than any negotiating tactic.
• Evidence matters: at the end, the company must be able to show the status of every contract.

How such a project typically runs with an interim team is described in Contract remediation with a team of project lawyers. This guide focuses on the regulatory triggers and on planning.

Triggers: DORA, IBOR transition, data protection and the supply chain

Most repapering projects in financial services and other regulated businesses go back to four triggers. The table shows what each requires in the contract.

A fifth, non-regulatory trigger is the supply chain: new group policies, a change of supplier, an acquisition or a carve-out in which contracts have to be transferred.

DORA in detail: financial entities keep a register of information on all contractual arrangements with ICT third-party service providers and distinguish those that support critical or important functions (Article 28(3) DORA). Article 30(2) sets the minimum terms for all ICT contracts; Article 30(3) adds further terms for critical or important functions. For the wider DORA workload, see DORA workstreams for legal and compliance.

Data protection in detail: contracts concluded before 27 September 2021 on the old standard contractual clauses were deemed to provide appropriate safeguards only until 27 December 2022 (Article 4(4) of Implementing Decision (EU) 2021/914). Legacy contracts that were never switched over are therefore a common finding in the inventory. In Switzerland, standard data protection clauses approved, issued or recognised in advance by the Federal Data Protection and Information Commissioner (FDPIC) are permitted (Article 16(2)(d) FADP).

A six-step approach

A remediation project usually follows six steps. The order matters: if you negotiate before you have a clause standard, you renegotiate every contract from scratch.

1. Inventory: find every relevant contract, including those outside the contract management system (procurement, IT, business units), and capture the core data: counterparty, term, notice period, contact.
2. Classification: map each contract to its trigger and criticality, for example ICT service supporting a critical or important function, processor agreement or benchmark.
3. Clause standard: set a standard clause, a fallback position and an escalation rule for each gap, plus an amendment template.
4. Outreach: send counterparties the amendment with a short explanation and a deadline, and track responses centrally.
5. Negotiation: handle deviations according to the escalation rules; questions of principle go to the in-house legal team.
6. Filing and evidence: store signed amendments, update contract data and registers, and document any remaining gaps with reasons.

Start with a sample of 20 to 30 contracts (editorial assumption). It shows how well the review grid works and how long an average contract takes.

Team and roles

A remediation team combines a few experienced people with several project lawyers. Direction and responsibility for the result stay with the company.

• Project owner in the company: general counsel, head of legal or legal operations; sets goals, review grid and approvals.
• Team lead (senior, 7+ years): allocates work, runs four-eyes quality checks and reports weekly.
• Project lawyers (junior to experienced, 0–6 years): review contracts, log deviations, prepare amendments and handle correspondence.
• Contract managers: maintain core data, the contract management system and registers.
• Specialists as needed: ICT and outsourcing law, data protection, banking and capital markets law.

Alpinum Solutions provides project lawyers, contract managers and team leads through staff leasing and freelancing, part time or full time, for the duration of the project. Selected profiles are usually available within 48 hours; the start date is agreed between the company and Alpinum.

Estimating the effort

Effort depends on the number of contracts, review time per category and the share that needs negotiation. The table shows a worked example; the figures are assumptions and do not replace your own sample.

At about 29 productive hours per week per full-time person (42-hour week, 70% productive time), that is roughly 60 person-weeks, for example three project lawyers over five months, plus a team lead and project management. For capacity planning in more detail, see Clearing a contract review backlog.

Limits and risks

• Accountability stays with the company: under DORA, financial entities remain fully responsible for compliance with their obligations at all times (Article 28(1)(a) DORA). The remediation team works under your direction and approvals.
• Bargaining power: large ICT providers often accept only their own addenda. Decide in advance which deviations are acceptable and who decides.
• Incomplete inventory: contracts outside the system otherwise surface only during an audit.
• No legal advice: Alpinum provides professionals; questions of legal principle are decided by your legal team, with a law firm where needed.

FAQ on contract remediation and repapering

What does contract remediation mean?

Contract remediation means reviewing an existing contract portfolio against one set of criteria and bringing it into line with new requirements, usually through amendments. Triggers include regulatory duties such as DORA, data protection or benchmark rates, as well as acquisitions and group policies. The process is also called repapering. The goal is a complete, evidenced status across the whole portfolio.

Which contracts fall under Article 30 DORA?

All contractual arrangements of a financial entity for the use of ICT services provided by an ICT third-party service provider. The minimum terms in Article 30(2) apply to all of them. Where the service supports a critical or important function, the additional terms in Article 30(3) apply as well, such as access, inspection and audit rights and exit strategies.

How long does a repapering project take?

It depends on the number of contracts, review time per category, the share that needs negotiation and team size. Extrapolate the effort from a sample and divide it by the capacity you have. A portfolio of a few hundred contracts can often be worked through by a small team in a few months; negotiations with a handful of large providers usually take longest.

Which profiles do I need for contract remediation?

A team lead with senior experience, several project lawyers at junior to experienced level and a contract manager for data and registers. Specialists in ICT and outsourcing law, data protection or banking law join as needed. All profiles are available through staff leasing or freelancing, part time or full time.

Does DORA affect Swiss companies?

DORA applies directly to financial entities in the EU. Swiss financial institutions with EU subsidiaries are affected through those subsidiaries, and Swiss ICT providers with EU financial sector clients receive Article 30 amendment requests. For Swiss banks and insurers, FINMA Circular 2018/3 on outsourcing also governs outsourcing arrangements.

Next step

Facing a contract remediation project? Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region. Tell us about the trigger, the contract portfolio and the timeline, and you will receive selected profiles for project lawyers, contract managers and a team lead.

• Contract review with project lawyers
• Contract remediation with a team of project lawyers
• DORA workstreams for legal and compliance
• Roles & practice areas: all guides on legal and compliance assignments
• Discuss your needs

Last updated: 11 November 2026.