Short Reads

Countdown 1 week until GDPR : Will processors have the same obligations, legal requirements, and the same sanctions as controllers do?

Stibbe - Will processors have to fulfill the same compliance obligatio

Countdown 1 week until GDPR : Will processors have the same obligations, legal requirements, and the same sanctions as controllers do?

17.05.2018 EU law

Only 1 more week to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will processors have to fulfill the same compliance obligations, meet the same legal requirements, and have the same sanctions for not complying with the GDPR as controllers do?

Under the GDPR, processors must adhere to more compliance obligations and legal requirements compared to the current regulatory framework, but not to the same extent as that which are required of the controllers.

For example, processors will have to implement appropriate technical and organizational measures to ensure a level of security that is appropriate to the risk, designate a data protection officer, satisfy the conditions of transfers of personal data to a recipient in a third country or an international organization under very similar conditions to the ones that apply to controllers.

Processors will have to keep records of their processing activities, but the information to be included in such records differs from the records to be kept by the controller.

Privacy impact assessments or notification of personal data breaches will remain the main responsibility of the controller, even though the processor will have to assist in complying with obligations pertaining to such assessments and data breaches.

Sanctions for violations of the GDPR are the same for both controllers and processors, but the application thereof will of course depend on the circumstances of each individual case, including the degree of responsibility of the controller or processor for the violation at stake.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

18.02.2019 NL law
Brexit and data protection: preparing for a 'no-deal'

Short Reads - As it stands, the UK will exit the European Union at midnight on 29 March 2019. Therefore, businesses within the UK, or with trade relations with the UK, would be best advised to assume that a no-deal Brexit is inevitable. The exchange of personal data  within the EU is governed by the General Data Protection Regulation (GDPR). In a no-deal Brexit, the GDPR will cease to be applicable in the UK upon its EU exit.

Read more

18.02.2019 EU law
Erik Valgaeren moderates a panel on Data Governance and Compliance during IBA's Silicon Beach Conference

Speaking slot - The discussion topic will cover various legal aspects relating to data lifecycle management, both for personal and non personal data. These aspects will include rights in and obligations regarding data, such retention obligations and portability rights. Practical suggestions on holistic data management and the role of the chief data officer will be debated.

Read more

Our website uses cookies: third party analytics cookies to best adapt our website to your needs & cookies to enable social media functionalities. For more information on the use of cookies, please check our Privacy and Cookie Policy. Please note that you can change your cookie opt-ins at any time via your browser settings.

Privacy – en cookieverklaring