EUGDPRController ProcessorEASYFree question
Under GDPR, must the processing relationship between a controller and processor be documented?
- A.No, verbal agreements are sufficient
- B.Only for cross-border processing
- C.Only if the supervisory authority requests it
- D.Yes, processing must be governed by a contract or other legal act under Article 28
Why D is correct
Article 28(3) requires that processing by a processor be governed by a contract or other legal act that sets out the subject matter, duration, nature, and purpose of processing, the type of data, and the obligations and rights of the controller.
Know someone studying for GDPR? Send them this one.