- elektronische gegevensverwerker
- a machine for performing calculations automatically
- ‘processor’ means any body which processes personal data on behalf of the controller;
- The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor, pursuant to paragraph 2.
- ‘the sub-processor’ means any processor engaged by the data importer or by any other sub-processor of the data importer who agrees to receive from the data importer or from any other sub-processor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
- Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller.
- Moreover, where the sub-processor fails to fulfil his own data-processing obligations under the contract, the data importer should remain liable toward the data exporter.
- Personal data may be processed by a processor only on the basis of a legal act or a written contract.
- to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.
- This requirement may be satisfied by the sub-processor co-signing the contract entered into between the data exporter and the data importer under this Decision.
- Since this Decision applies only to subcontracting by a data processor established in a third country of his processing services to a sub-processor established in a third country, it should not apply to the situation by which a processor established in the European Union and performing the processing of personal data on behalf of a controller established in the European Union subcontracts his processing operations to a sub-processor established in a third country.
- ‘sub-processor’ means any processor engaged by the data importer or by any other sub-processor of the data importer and who agrees to receive from the data importer or from any other sub-processor of the data importer personal data exclusively intended for the processing activities to be carried out on behalf of the data exporter after the transfer in accordance with the data exporter’s instructions, the standard contractual clauses set out in the Annex, and the terms of the written contract for sub-processing;
- Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on instructions from the data importer.
- The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.
- a competent authority has established that the data importer or a sub-processor has not respected the standard contractual clauses in the Annex; or
- The report on the implementation of Decisions on standard contractual clauses for the transfers of personal data to third countries recommended the establishment of appropriate standard contractual clauses on subsequent onwards transfers from a data processor established in a third country to another data processor (sub-processing), in order to take account of business trends and practices for more and more globalised processing activity.
- Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as are imposed on the data importer under the Clauses .