A controller wants to outsource processing of personal data to a processor. What must be done before outsourcing?

Question

Options

• AThe processor must show the controller that all demands agreed in the service level agreement
• BThe controller and processor must draft and sign a written contract guaranteeing the
• CThe controller must ask the supervisory authority for permission to outsource the processing of
• DThe controller must ask the supervisory authority if the agreed written contract is compliant with

• A
  2% (1)
• B
  90% (43)
• C
  6% (3)
• D
  2% (1)

Explanation

The controller must ask the supervisory authority for permission to outsource the processing of the data. Incorrect. The controller does not have to ask the supervisory authority for permission for each instance of outsourcing. The controller must ask the supervisory authority if the agreed written contract is compliant with the regulations. Incorrect. The supervisory authority is not a legal counsel and will not check contracts The controller and processor must draft and sign a written contract guaranteeing the confidentiality of the data. Correct. There must be a written contract guaranteeing the confidentiality of the data, listing the purposes and means of processing as defined by the controller and specifying that processor will only process on instruction of the controller. Both parties must sign this contract. (Literature: A, Chapter 8; GDPR Article 28 (3)) The processor must show the controller that all demands agreed in the service level agreement (SLA) are met. Incorrect. An SLA is not enough as it will focus on operations, not necessarily on purposes.

No community discussion yet for this question.