The processor, under the EU Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), is the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
By way of example, the following can be considered external processors of an organization:
- Payroll and labour consultant (consulente del lavoro);
- Accountant;
- IT systems maintenance service provider;
- Cloud service provider;
- External business consultant.
Article 28 of the GDPR specifies that the processor must provide sufficient guarantees to implement appropriate technical and organizational measures so as to ensure the protection of the rights of the data subject. In addition, the processor must be bound to the controller by a contract or other legal act under Union or Member State law, which sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller.
The contract or other legal act must provide, in particular, that the processor:
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by Union or national law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
-
ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
-
takes all appropriate technical and organizational measures to ensure the security of processing, (Article 32);
-
does not engage another processor without prior specific or general written authorization of the controller, (Article 28, paragraphs 2 and 4);
-
taking into account the nature of the processing, assists the controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligation to respond to requests for exercising the data subject's rights;
-
assists the controller in ensuring compliance with the security obligations, notification of a personal data breach to the supervisory authority, communication of a personal data breach to the data subject, data protection impact assessment and prior consultation, (Articles 32 to 36), taking into account the nature of the processing and the information available to the processor;
-
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies, unless Union or Member State law requires storage of the personal data;
-
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allows for and contributes to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
The controller appoints the external processor mainly by means of a written appointment on the company's/entity's letterhead, or through a data processing agreement. The second solution is often adopted by digital service providers. The contract and the agreement often include annexes containing the list of sub-processors and the list of security measures the processor must adopt.
In some cases, the controller may ask the processor to complete specific questionnaires to verify that the processor is GDPR-compliant, and may ask for evidence to back up what has been declared.
Recent, concrete cases help show how important it is to appoint an external processor. For example, in March 2021 the Lazio Region, as data controller, was fined 75,000 euros by the Italian Data Protection Authority (the Garante) for failing to designate as processor a cooperative company that had been entrusted with managing bookings for healthcare services.
N.B. External processors are generally required (subject to the Art. 30(5) exemption) to keep a record of processing activities carried out as processor pursuant to Art. 30 of the GDPR.
Has your organization been appointed as an external processor? Has your company not yet appointed its processors? Rely on Argo. Send us an email at info@argobs.com and tell us about your needs.