PL EN
Book a meeting
Chapter 4Data Processing
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 4.3
  1. 4.1Data Entrustment and Elements of the New Data Processing Contract
  2. 4.2New Challenges for Controller and Processor
  3. 4.3Recommendations

Recommendations

Maciej Gawronski, Aleksander P. Czarnowski & Patrycja Naklicka

In order to regulate the area of data entrustment in accordance with the GDPR, the following steps should be taken:

  1. 1)Create a new data processing contract or use a ready-made template (an extensive one such as the one we propose – developed on the basis of the GDPR and a proposal by the CNIL, the French supervisory authority, or a simplified version similar to what the leading cloud suppliers provide).
  2. 2)Update request for offer templates.
  3. 3)Ensure mechanisms are in place for verifying a processor to the subprocessor transfer of obligations.
  4. 4)Ensure mechanisms are in place for verifying basic obligations, e.g. signing confidentiality undertakings, verifying the controller’s consent to further data entrustment, and for reporting objections to subprocessing by the controller.
  5. 5)Create a record of categories of processing activities carried out on behalf of a controller.
  6. 6)Verify whether the processor is obliged to appoint a DPO.
  7. 7)Follow the activities of the European Commission, European Data Protection Board, and supervisory authorities.