When a subcontractor acts outside the instructions of the treatment manager to decide the purpose and means of treatment, he is considered responsible for the treatment of that treatment and assumes the same responsibility as a person responsible for the treatment. However, depending on the severity and nature of the injury, there are two levels of fines. Fines imposed on the RGPD for breaches of data processors are generally covered by the first stage, whose guidelines can be as serious as 10 million euros or 2% of global turnover. In any case, it is much less painful to sign a data processing agreement and to comply with the terms than to pay a penalty from the RGPD. We hope this guide will help. Other easy-to-digest helps for RGPD compliance can be accessed in our RGPD checklist. In essence, a CCA is a form of assurance that the subcontractor performs its duty of care to ensure the privacy of personal data. Yes, for example. B a controller and processor contract a privacy notice and the processor is in breach, the data protection authority could restrict the responsibility of the person in charge of handling the breaches. When a processing manager uses a subcontractor to process personal data on his or her behalf, there must be a written contract between the parties. The data processing agreement, as it is commonly referred to, is an important contractual document that outlines the responsibilities and responsibilities of the processing manager and subcontractor.
When a subcontractor uses another organization (i.e. a subcontract or „other” processor) to support the processing of personal data on behalf of a processor, it must have a written contract with that subcontractor. Many CSps reserve the right to use personal data for different purposes that have not been agreed with their (client) processing manager, which is particularly common when cloud services are provided free of charge by the PSC. Processors are required to hire data processors who provide sufficient assurance that this personal data will be processed in accordance with the RGPD. Organizations must therefore check whether the use of the PSC will result in additional complications and risks and possibly a violation of the RGPD. A first urgent question when creating a data processing agreement is whether the organization acts as a controller or processor. The IAPP has previously written in detail about the processor`s determination in relation to the processor, but in a nutshell, a responsible supplier is the unit that „determines the purposes and means of processing personal data,” while a subcontractor processes this personal data on behalf of the processor. Under the RGPD, personal data is all information about an identified or identifiable individual. Processing performs all transactions involving personal data.
It seems that the text of the RGPD dwells on these definitions. The RGPD is very specific with respect to the tasks of the processing manager and subcontractor, and Article 28, paragraph 3, of the RGPD stipulates that there must be a written contract between the person in charge of the processing and the subcontractor, in which the purpose of the processing and its duration, as well as its nature and nature, the nature of the personal data , the nature of personal data, the nature of personal data, are clearly explained. , specific categories of data, as well as the obligations and rights of both parties. With regard to the RGPD, the data protection officer appoints a data protection delegate and both parties must agree on a periodic review of the contractual terms. However, for many ambiguous requirements imposed on processing managers, subcontractors and subcontractors, companies may still have questions about certain legal requirements, for example. B what needs to be included in a data processing agreement.