Processor Agreement

The agreements with processors, agents, contractors and other service providers generally require them to act consistently with the applicant's obligations.

Engagement of processors requires a written contract specifying purposes, instructions, security and confidentiality.

When personal data is processed by a third party on behalf of the controller, the relationship must be governed by a contract that ensures the processor uses the data only as instructed, applies adequate security, and returns or destroys data at the end of the...

Those agreements generally require processors, agents and contractors to abide by the organisation's Global CBPR-compliant policies or implement substantially similar practices, follow its handling instructions, restrict subcontracting without its consent, be...

Controllers must update third-party processor agreements to comply with the NDPR; design systems and processes that make data requests and access seamless, let data subjects easily correct or update their data and transfer it to another platform or person at m...

The processor must (1) process only on the controller's instructions unless they are contrary to law or the Act; (2) provide appropriate security measures against unauthorised or unlawful loss, access, use, alteration, correction or disclosure and notify the c...