As an alternative to the return of personal data (or other data), the processing manager may, at his sole discretion, order in writing to the subcontractor that all or part of the personal data (or other data) is erased by the subcontractor, unless the binding law prevents the subcontractor from erasing the personal data. Our DATA AGENCY provides a number of guarantees to companies that entrust us with personal data. For example, ProtonMail`s data processing agreement promises the use of technical security measures, such as encryption, in accordance with Article 32 of the RGPD. In addition, it provides appropriate support to those responsible for processing in the implementation of a data protection impact assessment. These clauses are governed by the law of the country where the data exporter is established, with the exception of laws and regulations relating to the processing of personal data by the importer of data in accordance with Clause II, point h. Consider providing services from the subcontractor to the controller (or subprocessor) to the processor. The descriptions in the agreement should accurately reflect the processing of the data. (B) The company wishes to provide the data processor with certain services that involve the processing of personal data. 8.
The data protection impact analysis and the pre-consultation subcontractor provide the company with appropriate support for all data protection impact assessments and prior consultations with supervisory authorities or other relevant data protection authorities that the company deems reasonably necessary under Articles 35 or 36 of the RGPD or the equivalent provisions of another data protection law. , in any event exclusively with regard to the company`s handling of personal data and taking into account the nature of the processing and data protection information. that are available to contract processors. The details of the transmission (as well as the personal data collected) are contained in Appendix B, which is an integral part of the clauses. A data transfer contract must be processed: the specific obligations for RGPD processors are listed below and must be reflected in the agreement between the manager and the subcontractor (or the processor and subcontractor). The subcontractor must comply with all personal data protection provisions set out in this data processing agreement and applicable data protection legislation that are relevant to the processing of personal data. Under the RGPD, data transfer agreements for subcontractors (and subcontractors) must contain specific provisions and descriptions of the data, and in general, the obligations and rights of the processing manager should be taken into account in the agreement. The subcontractor is not allowed to keep a copy of the data provided by the data protection officer in any format, and all physical and logical access to that personal data or other data is removed. The EU`s general data protection regulation is more serious about contracts than previous EU data protection rules. If your organization is subject to the RGPD, you must have a written data processing agreement with all data processors. Yes, a data processing agreement is boring paperwork.
But it is also one of the most fundamental steps of RGPD compliance and necessary to avoid RGPD sanctions. When a transfer agreement is executed separately with the main service agreement, interaction with the main agreement must be carefully considered.