#1.1 Introductory Remarks
The entrustment of data was regulated directly by the ten paragraphs of Article 28 GDPR, which established a large number of requirements concerning the relations between a controller and a processor. Pending publication by the European Commission of a template data processing contract (under the prerogative of Article 28 paragraph 7 GDPR), below we provide a comprehensive checklist for a data processing contract.
#1.2 Sufficient Guarantees of Compliance
A data processing contract (or another document) should describe a processor’s guarantees that it will implement technical and organisational measures that ensure its processing meets the requirements of the General Data Protection Regulation (GDPR) and protect the rights of data subjects. Article 28 paragraph 1 GDPR, this requirement stems from, allows for a very broad range of interpretations as to what should be required of a processor. The technical and organisational measures referred to in Article 32 GDPR, for example, concern the protection of data, but Article 28 paragraph 1 GDPR speaks about guaranteeing that the requirements of the GDPR itself are met; in principle, this could cover all of the obligations of both the controller and the processor, not only personal data security. Such guarantees can be set out in a preamble to a contract or in declarations and warranties of the data processor to do the processing, or may also comprise a description or attachment of references, or a description of the processor’s experience in providing services that are GDPR compliant. The data controller may also require the data processor to complete a survey on technical and organisational measures of protection of personal data and other aspects of personal data protection compliance. The controller may even wish to perform an audit of the data processor. Recital 81 of the GDPR specifies that this concerns such guarantees as: expert knowledge, reliability and resources. According to it, the processor can demonstrate compliance by means of an approved code of conduct or approved mechanism of certification.
#1.3 Written Contract
Pursuant to Article 28 paragraph 9 GDPR, the entrustment of data processing or subprocessing must be in the form of a written (including electronic) contract or other legal act entered into by the controller and the processor. In short, a data processing agreement should be documented.
#1.4 Consent to Subprocessing
According to Article 28 paragraph 2 GDPR, a data processor is obliged to obtain the consent of the controller if it wishes to make use of the services of another processor. That authorisation may be initially general, but then the processor must notify the controller of the ‘intended’ addition or replacement of any subprocessor so that the controller has an opportunity to object to the changes (right of objection). So, at the end of the day, the controller should be notified in advance about each subprocessor (including sub-subprocessor and so on, as it stems from Article 28(4) GDPR – explained below).
#1.5 ‘Cloning’ of Obligations onto Subprocessors
Pursuant to Article 28 paragraph 4 GDPR, a processor when engaging a subprocessor should impose on a subprocessor the same data protection obligations as set out in the processor’s agreement with the controller (at least within the scope defined in Article 28 paragraph 3 GDPR, but also concerning ‘providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of’ GDPR).
#1.6 Ban on ‘Empty Shells’
Article 28 paragraph 4 GDPR permits yet another conclusion to be drawn: it states that ‘a processor engages another processor for carrying out specific processing activities on behalf of the controller’. This would seem to indicate that the GDPR provides only for specific activities to be subcontracted out, and not data processing as a whole. The wording of the GDPR requires interpretation, but certainly it will be in the interest of the controller to ensure that its direct contractual partner (the processor) is not a mere shell acting to save entities hiding on the lower levels of liability (a structure often implemented by global vendors acting through their ‘partners’).
#1.7 Subject Matter of the Processing
A contract should set out the subject matter and duration of the processing, its nature and purpose, the categories of personal data involved, and the types of data subjects the data concern. And so, the subject of the contract should not only take account of the data processing itself (i.e., the technical measures to be taken by the processor) but also define the purpose for which the controller wishes to process the data, the categories of persons whose data will be processed, and the scope of data processing (categories of personal data). Providers of IT solutions and services have commonly defended themselves against taking on any conscious responsibility for their ‘clients’ business’. Clearly, this approach should not pass muster under the GDPR.
#1.8 ‘Written’ (i.e., Documented) form of Controllers’ Instructions
A processor may process personal data solely on the basis of a documented instruction from a personal data controller. An exception to this is when the processor is obliged to do so by law, in which case it must inform the controller about the processing unless the law forbids this. This is a classic contractual solution (Article 28 paragraph 3 letter a GDPR).
#1.9 Confidentiality Obligation
A processor is obliged to obtain an undertaking from persons involved in the processing (i.e., from its personnel assigned to perform a contract between the processor and the subprocessor) that they will maintain the secrecy of the data concerned, unless those persons are subject to a statutory duty to maintain secrecy (e.g., legal counsel). In practice, it is more manageable to require non-disclosure agreements from all persons having access to personal data than to deliberate who is covered by professional secrecy and who is not. The GDPR does not directly state how a controller is to hold a processor accountable for that obligation, or specifically: does a controller have the right to demand a list of personnel together with access to their confidentiality undertakings. Yet, in the meaning of Article 28 paragraph 3 letter h GDPR, a processor must make available to the controller ‘all information necessary to demonstrate compliance with the obligations laid down in this Article’, which no doubt means that information on confidentiality undertakings should also be provided (Article 28 paragraph 3 letter b GDPR).
#1.10 Data Security
Processing must guarantee data security as set out in Article 32 GDPR (security of processing). This is a primary duty of a processor. The controller and processor should agree what they understand by appropriate measures of data protection. The data security standard in place at a processor may be more strict or less strict than that at the controller. If the processing is selective or occasional, the standard may even be lower (still adequate to processing), but if the processor performs the same duties for a number of entities (e.g., acting as an infrastructural provider, cloud computing provider), then the standard of data protection must probably be higher (Article 28 paragraph 3 letter c GDPR).
#1.11 Response to Data Subject Rights
A processor is obliged to help the controller respond to data subject requests exercising their rights. It should do this ‘by appropriate technical and organisational measures’ – in this way the GDPR emphasises that processors should take steps to automate or properly staff their responses to requests from data subjects exercising their rights (Article 28 paragraph 3 letter e GDPR).
#1.12 Support for the Controller’s Security Obligations
A processor should work together with the controller when analysing data security risk and determining appropriate data protection measures, when evaluating the consequences for data protection and in consultations with the supervisory authority, when reporting data breaches, and when notifying persons affected by a breach of personal data.
#1.13 Notification of a Suspected Personal Data Breach
Apart from the obligation to support the PDC with security, a processor has a separate obligation to notify the controller of any breach of personal data, without undue delay.
This issue is addressed in Article 33 paragraph 2 GDPR and, given its importance, a separate contractual clause should be devoted to it. It is important to consider what is meant by ‘without undue delay’. The guidelines concerning reporting personal data breaches say that a processor should report a breach to the controller quickly enough to allow the controller to report it to the authority within seventy-two hours after having been informed of the breach by … the processor. Such approach is controversial as it omits the operational aspects of notification. Still it is how the European Union (EU) regulator perceives the case. The operational problem can be avoided to some extent if the processor immediately reports its suspicion of a breach to the controller, thereby allowing the controller to take part in its efforts to clarify the situation prior to a moment that breach is confirmed and seventy-two-hour notification deadline starts. The solution suggested in the WP29 Guidelines consisting of empowering a data processor to notify a breach on behalf of a controller does not seem feasible, or more precisely it does not address an operational issue of allowing a data controller to understand a situation (not even to be in control of the situation). In any case, until the Working Party Guidelines are updated after supervisory authorities are flooded with data breach notifications, we recommend taking account of Article 29 and proceeding as set out above.
#1.14 Deletion and Return of Data
A processor ‘deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data’ (Article 28 paragraph 3 letter g GDPR). The requirement to return data must be agreed in detail between the controller and the processor, because data may reside in various systems and locations, including, for example, email. We are far from suggesting email deletion; to the contrary, we believe storing emails is essential to accountability and each organisation is a controller in relation to its email correspondence. But as data deletion is a complicated and multilevel issue, a data processing agreement should be reasonably detailed in that regard. Of course, from the opposite perspective, being vague and general allows to adjourn deciding on uncertain and doubtful details hoping that before they need to be decided proper market standards and interpretations are developed.
Technically, probably deleting data of a particular data controller corresponds to the problem of deleting data at the request of a data subject. The GDPR does not rule out agreeing a certain extended period during which a processor may store data. To avoid legal disputes it would be better to formulate such period as a ‘deletion period’, ‘data expiration period’ or similarly, and not as a period ‘after the end of the provision of services relating to processing’.
What about keeping data for know-how purposes or defence from claims?
As for know-how purposes, if a data processor properly anonymised data (ensuring reidentification is impossible), they would fall out of the scope of GDPR. Not that a data controller would always be happy to allow for such use of their data but that would be a trade secret issue.
Keeping data by a data processor for legal claims is an interesting situation. Storing data ‘just in case’ for some extra time after a termination of a data processing agreement would turn a data processor into a data controller, and it would most likely be against the data processing agreement (Article 28(3)(g) GDPR). But what if a termination of a data processing agreement is connected with a dispute related to the way entrusted data were being processed, or if a supervisory authority initiated administrative proceedings against a data processor? Should that data processor still delete entrusted data or should it keep the data? The GDPR does not provide a direct simple answer to such – quite likely – situations. We believe that a data processor deciding to keep entrusted data turns into a data controller. We also believe that if data kept are truly needed for dealing with ‘legal claims’ keeping those data would not infringe the GDPR (despite the general rule of Article 28(10) GDPR). And we believe that a data processor (turned into a data controller) could often rely on the exception to the information duty contained in Article 14(5)(b) GDPR, as (and when) informing data subjects about the fact that their data have been retained by a data processor ‘is likely to […] seriously impair the achievement of the objectives of that processing’. The objective of processing would then be allowing to decide the legal dispute with the least collateral damage to the parties involved. Informing data subjects about that dispute could be detrimental to the reputation of involved parties no matter what the outcome would be. Unless the dispute concerns or impacts rights or freedoms of data subjects, it would not make sense to let them know about such dispute. From the other perspective, say a data processor decides to file as evidence with a court a copy of the whole database containing personal data. Should persons involved be informed about it? We would probably find a good exception in Article 14(5)(c) GDPR which allows to refrain from completing the information obligation if ‘obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject’ – such law being rules of respective civil, administrative, or criminal procedure.
#1.15 Obligation to Demonstrate Compliance with the Contract
A processor is obliged to provide the controller with whatever information is necessary to demonstrate the processor’s compliance with the contract (Article 28 paragraph 3 letter h GDPR). Under that obligation, the processor should inter alia, in our opinion, grant the controller access to the part of its data processing register concerning that specific controller.
#1.16 Subjection to Audits
A processor must ‘allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller’ (obligation to cooperate) (Article 28 paragraph 3 letter h GDPR).
The problem of simultaneous audits is well known for cloud computing providers, but solutions to that problem are also reasonably developed (mostly independent third-party audits).
#1.17 Additional Payment
It is not stated that a processor’s obligations that are ‘auxiliary’ in nature must be performed within the basic service price. Certainly, a contract should contain some sort of basic package, but extraordinary work performed beyond that package may be settled separately.
#1.18 Information on the Legality of Instructions
The processor is obliged to promptly inform the controller about any doubts it has regarding the legality of a controller’s instruction. Call centres are already requiring that their clients demonstrate they have consents to communications for the purposes of direct marketing (Article 28 paragraph 3 section 2 GDPR). We see no legal basis, however, for a processor being entitled to notify the supervising authority in each case about a ‘suspected breach of the GDPR’.
#1.19 Procedure for Determining Legality
The issue of the legality of a controller’s instructions can often lead to dispute, which is why the GDPR provides that the parties institute an escalation procedure and rules for resolving doubts (e.g., by seeking a legal opinion from an agreed law firm, the costs to be shared equally).
#1.20 Rules of Responsibility
A data processing contract will usually contain provisions on responsibility. It makes sense to include provisions on cooperation in the event of proceedings before the supervisory authority or litigation brought by a data subject. Both the processor and the controller may be directly held responsible for a data processing breach. Article 82 paragraph 2 sentence 2 GDPR states that: ‘A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.’ We discuss liability separately.
#1.21 Designation of a Data Protection Officer
The Regulation requires this in specific cases (Article 37 GDPR).