AI Summary of Article 28 Processor
This document outlines the responsibilities of data processors when handling personal data on behalf of data controllers, emphasising the necessity for sufficiency in technical and organisational safeguards to comply with data protection regulations.
It mandates that processors engage other processors only with prior written consent and ensure that the same data protection obligations are enforced in sub-processing agreements. Additionally, the contract should stipulate the measures for confidentiality, compliance, and audit transparency, reinforcing the processor's accountability and the necessity to safeguard data subjects' rights throughout the processing lifecycle.
Article 28 Processor
1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.
2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.