Facilitating the entrustment of data processing

As soon as 27 June 2021, the European Commission's decision on standard contractual clauses between controllers and processors (to be used in data processing contracts) under Article 28(7) of Regulation 2016/679 will become effective.

Standard contractual clauses are a set of model provisions of a data processing contract. Thanks to them, the controller intending to entrust a processor with processing activities will be certain how to do so in accordance with Article 28 of GDPR. It is a new solution introduced by GDPR to facilitate conclusion of data processing contracts.

The standard contractual clauses specify the basic obligations of the parties to data processing contract. Such issues as the conditions and obligations relating to the further entrustment of data processing (entrusting data processing to a sub-processor) have been specified in detail. The rules of cooperation between the controller and the processor in the case of fulfilling the requests of data subjects or notifying data protection breaches to the supervisory authorities are also regulated.

It is also provided for situations in which the contract between the parties may be terminated. This may happen, for example, if the processor is in substantial or persistent breach of the standard contractual clauses . On the other hand, the processor will be entitled to terminate the contract if the controller insists on compliance with the instructions after being informed by the processor that its instructions infringe applicable legal requirements.

These Clauses do not by themselves ensure compliance with obligations related to international transfers. In this regard, the European Commission has adopted a separate set of standard contractual clauses.

Link to the decision:

Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council

2021-06-22 Metadane artykułu