Legal Due Diligence · glossary
The written contract Article 28 of the GDPR requires before a processor handles personal data for a controller. It must say, for example, that the processor acts only on instructions. Solaris's analytics provider worked without one for over a year, until it was signed during the review. Report §8.1 · Chapter 10
Explained in Chapter 10, IP, IT and Data, of Legal Due Diligence.
Article 28 of the GDPR lets a controller use a processor only under a binding written contract. This is the data processing agreement (DPA). Article 28 also lists what it must say, such as acting only on instructions and deleting or returning the data at the end. Without a DPA, the outsourcing is unlawful, however good the processor is.Read Chapter 10, IP, IT and Data →
Chapter 1 and this glossary are open to everyone; the whole edition is free to read with a free account until 31 January, and it stays open to an account opened by then.Chapter 1 of Legal Due Diligence and this glossary are free to read; the rest of the edition is in the Library, at €12 a month or €79 for a Year Pass.
Related terms
Where this term lives
This term is part of one complete fictional deal, with every document attached and a test after every chapter. Open Legal Due Diligence → · All terms A–Z →