Processing Agreement

Personal data may not be processed just like that. Companies and organizations that want to process personal data must comply with the GDPR (AVG) (and the U-AVG). The GDPR regulates that controlling always remains obligatory for the processing of personal data.

According to the GDPR, it, therefore, does not matter whether the controller processes the personal data itself or whether it outsources this to another party – a processor. However, this final responsibility does not affect the fact that the processor also has responsibilities under the GDPR. The parties must arrange responsibility for the careful processing of personal data in a processor agreement. If the parties fail to do so, they will both be in violation of the GDPR. 

The GDPR requires that the processing agreement has to be written and cover the agreements for the careful processing of personal data.

The processing agreement must in any case address the following subjects:

• general description of the processing (subject, duration, nature, the purpose of the processing, the type of personal data, the categories of data subjects, rights and obligations of controllers);
• in principle, the processing may only take place on the basis of written instructions from the controller;
• the processor may not use the personal data for his own purposes;
• parties involved in the processing, such as employees and hired workers, must observe secrecy;
• the personal data must be adequately secured (technically and organisationally), such as through pseudonymisation and encryption of personal data, information security, restoration of availability, access to data in the event of incidents and regular security tests;
• sub-processors may not be engaged just like that, in principle, this requires the prior written permission of the controller;
• the sub-processor must be held to the same obligations as the processor towards the controller;
• the processor remains liable for breaches of obligations by sub-processors;
• the processor must cooperate in complying with the privacy rights of data subjects, such as
  • the right of access,
  • the right of correction,
  • the right to be forgotten,
  • the right to data portability
• the processing must cooperate in the fulfilment of other obligations, such as
  • • reporting data breaches
    • performing a data protection assessment (DPIA)
    • audits
    • any prior consultation of the Dutch Data Protection Authority
• the processor must delete data after the processing service has ended unless this is required by law, or any return obligation.

The processing agreement may not contain agreements that are contrary to the GDPR. In that case, the GDPR takes precedence over what has been arranged in the processing agreement.