Processor contracts
Art. 28
-
Last updated
Mandatory
Catalog reference
Use only processors that provide sufficient guarantees, and govern the relationship with a written contract (or other legal act) covering the subject matter, duration, nature and purpose of processing, the processor's obligations (confidentiality, sub-processor authorisation, assistance with rights requests and security, deletion/return of data on termination, and audit cooperation).
Narrative — how we satisfy this requirement
Processor agreements are in place with the main sub-processors, and the remaining ones are being moved onto the standard data processing agreement.