Data Processing Agreement Gdpr Example

Make sure that you do not process data or share data with subcontractors without this agreement existing and being signed by both parties. The controller and the processor must also ensure that any person who works (or has access to the data) only processes the data in accordance with the instructions of the controller (as set out in Article 29). Article 36 follows on from the FDFA issue raised in Article 35, concerning notification to the supervisory authority. It stipulates that controllers must consult the supervisory authority when a DSFA presents a high risk and the controller nevertheless wishes to process the data.