menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Denmark) language
Contact our local member in Denmark mail_outline
Visit the website of Kim G. Hansen account_balance

arrow_backPrevious Article
Article 28
Next Articlearrow_forward

Processor

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 28 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 28 keyboard_arrow_up

Articles related to article 28

Key words related to article 28

Show the recitals of the Regulation related to article 28 keyboard_arrow_down Hide the recitals of the Regulation related to article 28 keyboard_arrow_up

(81) To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk to the rights and freedoms of the data subject. The controller and processor may choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by a supervisory authority in accordance with the consistency mechanism and then adopted by the Commission. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.

There is no recital in the Directive related to article 28.

The GDPR

Article 4 (8) defines the processor using the definition already available in the Directive. The processor is: “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller”.

Article 28 of the Regulation extends the previous duties of controllers and processors while organizing a separate regime for their duties for security referred to in Article 32 et seq.

As before, the controller can only choose contractors with sufficient safeguards with respect to taking of appropriate technical and operational measures to meet the requirements of the Regulation and to ensure protection of the rights of the data subject.

The principle is still that of a specific contract between the controller and the processor, or by another specific legal act provided for the needs of the Union or of a Member State, binding the subcontractor and the controller. On the other hand, the content of the written contract - including an electronically format is extended. In addition to information on the processing itself (purpose, scope and duration of processing, etc.), the contract provides for the commitment of the processor to comply with a range of duties vis-à-vis to the controller, namely:

- to process the personal data only on documented instructions from the controller – which was already provided – but these instructions will now be specifically documented - in particular the transfers of data to third countries – by the controller. An exception is made for the legal duties which would subject the contractor who will be the subject of specific information by the processor, except for a justified legal exception for important reasons of public interest;

This duty is also reflected in Article 32 requiring the controller to take measures to ensure that anyone who has access to data under the authority of the controller or the processor can process them only on their instructions, unless required to do so by the law of a member State or a rule of the EU and provided that they inform the controller accordingly, unless such information is prohibited for important reasons of public interest.

- to ensure that persons authorised to process the personal data have committed themselves to confidentiality ;

- to respect the conditions referred to in paragraphs 2 and 4 for engaging another processor (see below);

- to assist the controller for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights;

- to assist the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the Regulation;

- at the choice of the controller, to delete or return all the personal data to the controller after the end of the provision of services;

- to make available to the controller all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

Article 28 also requires the processor to immediately report to the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

In addition to the duties provided for by the Directive, the Regulation organizes the question of processing entrusted to third parties - secondary processors by the direct processor of the processing controller, very common cases in practice. Thus, the possibility left to the secondary processor of the processor itself will be subject to a prior written consent (specific or general) by the controller. In the case of a written general authorization, the direct processor must inform the controller, prior to any change of the "secondary" processor to enable the controller to object.

In addition, this secondary processor contract must comply with the rules applicable to the content of the contract entered into between the controller and the main processor (Art. 28 (4)). Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.

Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which the processor shall demonstrate sufficient guarantees.

The Regulation expressly provides the possibility of using standard contractual clauses provided by various sources as the basis of the specific contract between the controller and the processor (included in a procedure of certification, of the Commission or the supervisory authorities). The Commission is also empowered to establish standard contractual clauses for the matters referred to in paragraphs 3 and 4, in accordance with the consistency mechanism referred to in Article 63.

Finally, the last version of the Regulation specifically indicates that if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.

The Directive

Article 17 of the Directive organized the system of processors as part of the security obligations. The Directive provided that the controller who acts through a processor should ensure that such processor provides sufficient guarantees as to the implementation and the compliance with the security measures to be implemented.

A binding legal contract or act should bind the controller and the processor, the latter having to state in particular that he or she will act only on instructions from the controller, as well as the safety measures he or she had to take.

Potential issues

The precision and the extension of contractual clauses, extensive references to the links to the secondary processor impose to the controllers to review all their relations with their processors and to amend extensively the previous contracts. Often, in practice, general references were contained in only one style clause inserted in the service provision contract. The processor - often a technology provider - must attach more importance to the data protection and the obligations that go beyond the simple measures of security, but requires a much more professional contract management.

arrow_back Previous Article • Article 28 • Next Article arrow_forward
arrow_back Previous Article • Article 28 Next Article arrow_forward

Summary

European Union

European Union

European data protection board (EDPB)

Opinion on the draft Standard Contractual Clauses submitted by the DK SA (Article 28(8) GDPR) - 14/2019 (9 July 2019)

The competent supervisory authority of Denmark has submitted its draft standard contractual clauses (hereafter SCCs) to the Board via the IMI system requesting an opinion from the Board pursuant to Article 64(1)(d) for a consistent approach at Union level. The decision on the completeness of the file was taken on the 4th of April 2019. The Board Secretariat circulated the file to all members on behalf of the Chair on the 4th of April.

The Board has received the draft SCCs from the Danish SA2 along with a letter explaining the structure of the standard contractual clauses. These two documents were provided by the Danish SA in an English version. The Board hereby gives its opinion on the English version of the document although the Board notes that the SCCs is also available in Danish on the website of the Danish SA. The Danish SA shall take utmost account of the opinion of the Board.

 In compliance with Article 10(2) of the Board Rules of Procedure3 , due to the complexity of the matter at hand, the Chair decided to extend the initial adoption period of eight weeks by a further six weeks (until the 9th of July 2019).

Link

Guidelines on the concepts of controller and processor in the GDPR - 7/2020 (2 September 2020)

The concepts of controller, joint controller and processor play a crucial role in the application of the General Data Protection Regulation 2016/679 (GDPR), since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. The precise meaning of these concepts and the criteria for their correct interpretation must be sufficiently clear and consistent throughout the European Economic Area (EEA). The concepts of controller, joint controller and processor are functional concepts in that they aim to allocate responsibilities according to the actual roles of the parties and autonomous concepts in the sense that they should be interpreted mainly according to EU data protection law.

Controller

In principle, there is no limitation as to the type of entity that may assume the role of a controller but in practice it is usually the organisation as such, and not an individual within the organisation (such as the CEO, an employee or a member of the board), that acts as a controller. A controller is a body that decides certain key elements of the processing. Controllership may be defined by law or may stem from an analysis of the factual elements or circumstances of the case. Certain processing activities can be seen as naturally attached to the role of an entity (an employer to employees, a publisher to subscribers or an association to its members). In many cases, the terms of a contract can help identify the controller, although they are not decisive in all circumstances. A controller determines the purposes and means of the processing, i.e. the why and how of the processing. The controller must decide on both purposes and means. However, some more practical aspects of implementation (“non-essential means”) can be left to the processor. It is not necessary that the controller actually has accessto the data that is being processed to be qualified as a controller.

Joint controllers

The qualification as joint controllers may arise where more than one actor is involved in the processing. The GDPR introduces specific rules for joint controllers and sets a framework to govern their relationship. The overarching criterion for joint controllership to exist is the joint participation of two or more entities in the determination of the purposes and means of a processing operation. Joint participation can take the form of a common decision taken by two or more entities or result from converging decisions by two or more entities, where the decisions complement each other and are necessary for the processing to take place in such a manner that they have a tangible impact on the determination of the purposes and means of the processing. An important criterion is that the processing would not be possible without both parties’ participation in the sense that the processing by each party is inseparable, i.e. inextricably linked. The joint participation needs to include the determination of purposes on the one hand and the determination of means on the other hand.

Processor

A processor is a natural or legal person, public authority, agency or another body, which processes personal data on behalf of the controller. Two basic conditions for qualifying as processor exist: that it is a separate entity in relation to the controller and that it processes personal data on the controller’s behalf. The processor must not process the data otherwise than according to the controller’s instructions. The controller’s instructions may still leave a certain degree of discretion about how to best serve the controller’s interests, allowing the processor to choose the most suitable technical and organisational means. A processor infringes the GDPR, however, if it goes beyond the controller’s instructions and starts to determine its own purposes and means of the processing. The processor will then be considered a controller in respect of that processing and may be subject to sanctions for going beyond the controller’s instructions.

Relationship between controller and processor

A controller must only use processors providing sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR. Elements to be taken into account could be the processor’s expert knowledge (e.g. technical expertise with regard to security measures and data breaches); the processor’s reliability; the processor’s resources and the processor’s adherence to an approved code of conduct or certification mechanism. Any processing of personal data by a processor must be governed by a contract or other legal act which shall be in writing, including in electronic form, and be binding. The controller and the processor may choose to negotiate their own contract including all the compulsory elements or to rely, in whole or in part, on standard contractual clauses. The GDPR lists the elements that have to be set out in the processing agreement. The processing agreement should not, however, merely restate the provisions of the GDPR; rather, it should include more specific, concrete information as to how the requirements will be met and which level of security is required for the personal data processing that is the object of the processing agreement.

Relationship among joint controllers

Joint controllers shall in a transparent manner determine and agree on their respective responsibilities for compliance with the obligations under the GDPR. The determination of their respective responsibilities must in particular regard the exercise of data subjects’ rights and the duties to provide information. In addition to this, the distribution of responsibilities should cover other controller obligations such as regarding the general data protection principles, legal basis, security measures, data breach notification obligation, data protection impact assessments, the use of processors, third country transfers and contacts with data subjects and supervisory authorities. Each joint controller has the duty to ensure that they have a legal basis for the processing and that the data are not further processed in a manner that is incompatible with the purposes for which they were originally collected by the controller sharing the data. The legal form of the arrangement among joint controllers is not specified by the GDPR. For the sake of legal certainty, and in order to provide for transparency and accountability, the EDPB recommends that such arrangement be made in the form of a binding document such as a contract or other legal binding act under EU or Member State law to which the controllers are subject. The arrangement shall duly reflect the respective roles and relationships of the joint controllers vis-à- vis the data subjects and the essence of the arrangement shall be made available to the data subject. Irrespective of the terms of the arrangement, data subjects may exercise their rights in respect of and against each of the joint controllers. Supervisory authorities are not bound by the terms of the arrangement whether on the issue of the qualification of the parties as joint controllers or the designated contact point.

Link

Retour au sommaire

Article 29 Working Party

Opinion 1/2010 on the concepts of "controller" and "processor"- 1/2010 (16 Fébruary 2010)

 

The concept of data controller and its interaction with the concept of data processor play a crucial role in the application of Directive 95/46/EC, since they determine who shall be responsible for compliance with data protection rules, how data subjects can exercise their rights, which is the applicable national law and how effective Data Protection Authorities can operate. Organisational differentiation in the public and in the private sector, the development of ICT as well as the globalisation of data processing, increase complexity in the way personal data are processed and call for clarifications of these concepts, in order to ensure effective application and compliance in practice.

The concept of controller is autonomous, in the sense that it should be interpreted mainly according to Community data protection law, and functional, in the sense that it is intended to allocate responsibilities where the factual influence is, and thus based on a factual rather than a formal analysis. The definition in the Directive contains three main building blocks:

- the personal aspect ("the natural or legal person, public authority, agency or any other body");

- the possibility of pluralistic control ("which alone or jointly with others"); and

- the essential elements to distinguish the controller from other actors ("determines the purposes and the means of the processing of personal data"). The analysis of these building blocks leads to a number of conclusions that have been summarized in paragraph IV of the opinion. This opinion also analyzes the concept of processor, the existence of which depends on a decision taken by the controller, who can decide either to process data within his organization or to delegate all or part of the processing activities to an external organization. Two basic conditions for qualifying as processor are on the one hand being a separate legal entity with respect to the controller and on the other hand processing personal data on his behalf. The Working Party recognises the difficulties in applying the definitions of the Directive in a complex environment, where many scenarios can be foreseen involving controllers and processors, alone or jointly, with different degrees of autonomy and responsibility. In its analysis, it has emphasized the need to allocate responsibility in such a way that compliance with data protection rules will be sufficiently ensured in practice. However, it has not found any reason to think that the current distinction between controllers and processors would no longer be relevant and workable in that perspective. The Working Party therefore hopes that the explanations given in this opinion, illustrated with specific examples taken from the daily experience of data protection authorities, will contribute to effective guidance on the way to interpret these core definitions of the Directive.

Link

Retour au sommaire
arrow_back Previous Article • Article 28 Next Article arrow_forward
Retour au sommaire
arrow_back Previous Article • Article 28 Next Article arrow_forward
Regulation
1e 2e

Art. 28

1.   Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

2.   The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

3.   Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor:

a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

c) takes all measures required pursuant to Article 32;

d) respects the conditions referred to in paragraph 2 ans 4 for engaging another processor

e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III

f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor

g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data

h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

4.   Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.

5.   Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article.

6.   Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43.

7.   The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2).

8.   A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.

9.   The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.

10.   Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.
1st proposal close

Art. 26

1.           Where a processing operation is to be carried out on behalf of a controller, the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject, in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures.

2.           The carrying out of processing by a processor shall be governed by a contract or other legal act binding the processor to the controller and stipulating in particular that the processor shall:

(a)     act only on instructions from the controller, in particular, where the transfer of the personal data used is prohibited;

(b)     employ only staff who have committed themselves to confidentiality or are under a statutory obligation of confidentiality;

(c)     take all required measures pursuant to Article 30;

(d)     enlist another processor only with the prior permission of the controller;

(e)     insofar as this is possible given the nature of the processing, create in agreement with the controller the necessary technical and organisational requirements for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III;

(f)      assist the controller in ensuring compliance with the obligations pursuant to Articles 30 to 34;

(g)     hand over all results to the controller after the end of the processing and not process the personal data otherwise;

(h)     make available to the controller and the supervisory authority all information necessary to control compliance with the obligations laid down in this Article.

3.           The controller and the processor shall document in writing the controller's instructions and the processor's obligations referred to in paragraph 2.

4.           If a processor processes personal data other than as instructed by the controller, the processor shall be considered to be a controller in respect of that processing and shall be subject to the rules on joint controllers laid down in Article 24.

5.           The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the responsibilities, duties and tasks in relation to a processor in line with paragraph 1, and conditions which allow facilitating the processing of personal data within a group of undertakings, in particular for the purposes of control and reporting.
2nd proposal close

1. (...). The controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures (...) in such a way that the processing will meet the requirements of th is Regulation (...).

1a. The processor shall not enlist another processor without the prior specific or general written consent of the controller. In the latter case, the processor should always inform the controller on any intended changes concerning the addition or replacement of other processors, thereby giving the opportunity to the controller to object to such changes.

1b. (...)

2. The carrying out of processing by a processor shall be governed by a contract or a legal act under Union or Member State law binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, the rights of the controller (...) and stipulating, in particular that the processor shall:

(a) process the personal data only on instructions from the controller (...), unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing the data, unless that law prohibits such information on important grounds of public interest;

(b) (...)

(c) take all (...) measures required pursuant to Article 30;

(d) respect the conditions for enlisting another processor (...), such as a requirement of specific prior permission of the controller;

(e) (...) taking into account the nature of the processing, assist the controller in responding to requests for exercising the data subject’s rights laid down in Chapter III;

(f) (...) assist the controller in ensuring compliance with the obligations pursuant to Articles 30 to 34;

(g) return or delete, at the choice of the controller, the personal data upon the termination of the provision of data processing services specified in the contract or other legal act, unless there is a requirement to store the data under Union or Member State law to which the processor is subject;

(h) make available to the controller (...) all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits conducted by the controller. The processor shall immediately inform the controller if, in his opinion, an instruction breaches this Regulation or Union or Member State data protection provisions.

2a. Where a processor enlists (...) another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the cont roller and the processor as referred to in paragraph 2 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and or ganisational measures in such a way that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.

2aa. Adherence of the processor to an approved code of conduct pursuant to Article 38 or an approved certification mechanism pursuant to Article 39 may be used as an element to demonstrate sufficient guarantees referred to in paragraphs 1 and 2a.

2ab. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 2 and 2a may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 2b and 2c or on standard contractual clauses which are part of a certification granted to the controller or processor pursuant to Articles 39 and 39a.

2b. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 2 and 2a and in accordance with the examination procedure referred to in Article 87(2).

2c. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 2 and 2a and in accordance with the consistency mechanism referred to in Article 57.

3. The contract or the other legal act referred to in paragraphs 2 and 2a shall be in writing, including in an electronic form.

4. (...)

5. (...)
Directive close

Art. 17

(…)

2. The Member States shall provide that the controller must, where processing is carried out on his behalf, choose a processor providing sufficient guarantees in respect of the technical security measures and organizational measures governing the processing to be carried out, and must ensure compliance with those measures.

3. The carrying out of processing by way of a processor must be governed by a contract or legal act binding the processor to the controller and stipulating in particular that:

- the processor shall act only on instructions from the controller,

- the obligations set out in paragraph 1, as defined by the law of the Member State in which the processor is established, shall also be incumbent on the processor.

4. For the purposes of keeping proof, the parts of the contract or the legal act relating to data protection and the requirements relating to the measures referred to in paragraph 1 shall be in writing or in another equivalent form.
Denmark
compare_arrows

41. - (1)  Individuals, companies etc. performing work for the controller or the processor and who have access to data may process these only on instructions from the controller unless otherwise provided by law or regulations.

(2) The instruction mentioned in subsection (1) may not restrict journalistic freedom or impede the production of an artistic or literary product.

(3) The controller shall implement appropriate technical and organizational security measures to protect data against accidental or unlawful destruction, loss or alteration and against unauthorized disclosure, abuse or other processing in violation of the provisions laid down in this Act. The same shall apply to processors.

(4) As regards data which are processed for the public administration and which are of special interest to foreign powers, measures shall be taken to ensure that they can be disposed of or destroyed in the event of war or similar conditions.

(5) The Minister of Justice may lay down more detailed rules concerning the security measures mentioned in subsection (3).

 

42. - (1)  Where a controller leaves the processing of data to a processor, the controller shall make sure that the processor is in a position to implement the technical and organizational security measures mentioned in section 41 (3) to (5), and shall ensure compliance with those measures.

(2) The carrying out of processing by way of a processor must be governed by a written contract between the parties. This contract must stipulate that the processor shall act only on instructions from the controller and that the rules laid down in section 41 (3) to (5) shall also apply to processing by way of a processor. If the processor is established in a different Member State, the contract must stipulate that the provisions on security measures laid down by the law in the Member State in which the processor is established shall also be incumbent on the processor.
Spain close

Artículo 33. Encargado del tratamiento.

1. El acceso por parte de un encargado de tratamiento a los datos personales que resulten necesarios para la prestación de un servicio al responsable no se considerará comunicación de datos siempre que se cumpla lo establecido en el Reglamento (UE) 2016/679, en la presente ley orgánica y en sus normas de desarrollo.

2. Tendrá la consideración de responsable del tratamiento y no la de encargado quien en su propio nombre y sin que conste que actúa por cuenta de otro, establezca relaciones con los afectados aun cuando exista un contrato o acto jurídico con el contenido fijado en el artículo 28.3 del Reglamento (UE) 2016/679. Esta previsión no será aplicable a los encargos de tratamiento efectuados en el marco de la legislación de contratación del sector público.

Tendrá asimismo la consideración de responsable del tratamiento quien figurando como encargado utilizase los datos para sus propias finalidades.

3. El responsable del tratamiento determinará si, cuando finalice la prestación de los servicios del encargado, los datos personales deben ser destruidos, devueltos al responsable o entregados, en su caso, a un nuevo encargado.

No procederá la destrucción de los datos cuando exista una previsión legal que obligue a su conservación, en cuyo caso deberán ser devueltos al responsable, que garantizará su conservación mientras tal obligación persista.

4. El encargado del tratamiento podrá conservar, debidamente bloqueados, los datos en tanto pudieran derivarse responsabilidades de su relación con el responsable del tratamiento.

5. En el ámbito del sector público podrán atribuirse las competencias propias de un encargado del tratamiento a un determinado órgano de la Administración General del Estado, la Administración de las comunidades autónomas, las Entidades que integran la Administración Local o a los Organismos vinculados o dependientes de las mismas mediante la adopción de una norma reguladora de dichas competencias, que deberá incorporar el contenido exigido por el artículo 28.3 del Reglamento (UE) 2016/679.

Disposición transitoria quinta. Contratos de encargado del tratamiento.

Los contratos de encargado del tratamiento suscritos con anterioridad al 25 de mayo de 2018 al amparo de lo dispuesto en el artículo 12 de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal mantendrán su vigencia hasta la fecha de vencimiento señalada en los mismos y en caso de haberse pactado de forma indefinida, hasta el 25 de mayo de 2022.

Durante dichos plazos cualquiera de las partes podrá exigir a la otra la modificación del contrato a fin de que el mismo resulte conforme a lo dispuesto en el artículo 28 del Reglamento (UE) 2016/679 y en el Capítulo II del Título V de esta ley orgánica.

---

Article 33. Data processor.

1. Access by a processor to personal data that are necessary for the provision of a service to the controller shall not be considered communication of data provided that the provisions of Regulation (EU) 2016/679, this Organic Law and its implementing rules are complied with.

2. A person shall be considered a data controller and not a processor if, in his or her own name and without being acting on behalf of another person, he or she establishes relations with data subjects even if there is a contract or legal act with the content set out in Article 28(3) of Regulation (EU) 2016/679. This provision shall not apply to processing orders carried out within the framework of public sector procurement legislation.

The data controller shall also be considered as the person in charge of the processing who uses the data for his own purposes.

3. The controller shall determine whether, upon termination of the services of the processor, the personal data should be destroyed, returned to the controller or given to a new processor, as the case may be.

The destruction of the data will not proceed when there is a legal provision that obliges their conservation, in which case they must be returned to the person in charge, who will guarantee their conservation as long as such obligation persists.

4. The data processor may keep the data, duly blocked, for as long as liabilities may arise from its relationship with the data controller.

5. Within the scope of the public sector, the powers of a data processor may be attributed to a specific body of the General State Administration, the Administration of the Autonomous Communities, the Entities that make up the Local Administration or to the Bodies linked to or dependent on them through the adoption of a rule regulating such powers, which must incorporate the content required by Article 28.3 of Regulation (EU) 2016/679.

Fifth transitory provision. Contracts of data processor.

The data processor contracts signed prior to May 25, 2018 under the provisions of Article 12 of Organic Law 15/1999, of December 13, 1999, on the Protection of Personal Data shall remain in force until the expiration date indicated therein and, in the event that they have been agreed indefinitely, until May 25, 2022.

During such periods either party may require the other party to amend the contract in order to bring the contract into conformity with the provisions of Article 28 of Regulation (EU) 2016/679 and Chapter II of Title V of this Organic Law.
arrow_back Previous Article • Article 28 Next Article arrow_forward
close

2016 - www.itiplaw.eu.