Short Reads

Countdown 1 week until GDPR : Will processors have the same obligations, legal requirements, and the same sanctions as controllers do?

Stibbe - Will processors have to fulfill the same compliance obligatio

Countdown 1 week until GDPR : Will processors have the same obligations, legal requirements, and the same sanctions as controllers do?

17.05.2018 EU law

Only 1 more week to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will processors have to fulfill the same compliance obligations, meet the same legal requirements, and have the same sanctions for not complying with the GDPR as controllers do?

Under the GDPR, processors must adhere to more compliance obligations and legal requirements compared to the current regulatory framework, but not to the same extent as that which are required of the controllers.

For example, processors will have to implement appropriate technical and organizational measures to ensure a level of security that is appropriate to the risk, designate a data protection officer, satisfy the conditions of transfers of personal data to a recipient in a third country or an international organization under very similar conditions to the ones that apply to controllers.

Processors will have to keep records of their processing activities, but the information to be included in such records differs from the records to be kept by the controller.

Privacy impact assessments or notification of personal data breaches will remain the main responsibility of the controller, even though the processor will have to assist in complying with obligations pertaining to such assessments and data breaches.

Sanctions for violations of the GDPR are the same for both controllers and processors, but the application thereof will of course depend on the circumstances of each individual case, including the degree of responsibility of the controller or processor for the violation at stake.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

02.07.2019 NL law
Debate night: HR Analytics: opportunity or threat?

Seminar - On 2 July 2019, Stibbe's Digital Economy Group will host a debate night in Amsterdam on the hot topic of HR analytics. During Stibbe's debate night, speakers from the world of business, politics, science and law will exchange views on HR analytics, how they can be used in practice, and their development in the context of employment and privacy law.

Read more

06.06.2019 BE law
TMT Roundtable: Getting a handle on software quality

Roundtable - Erik Valgaeren, TMT Partner at Stibbe Brussels, and his team organize a roundtable on software quality in our Brussels office on June 6th, 2019. Software quality is a recurring theme in many matters handled by our TMT team. Whether our assistance relates to preparing tender documents, contracting effectively, assessing proper performance or allocating ownership and accountability in challenging IT projects, questions concerning software quality always arise.

Read more

06.06.2019 NL law
Masterclass: Alcohol and drug testing in the workplace

Masterclass - Stibbe will host a masterclass entitled 'Alcohol and drug testing in the workplace' on 6 June in Amsterdam. During this masterclass, employment law expert Johan Zwemmer and privacy experts Frederiek Fernhout and Judica Krikke will discuss the Dutch Data Protection Authority's general prohibition of these tests and discuss whether and how employers should implement.

Read more

07.06.2019 BE law
Part three - GDPR and public law: To retroact or not?

Articles - Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss the retroactive application of GDPR.

Read more

06.06.2019 NL law
Masterclass: Alcohol- en drugstesten op de werkvloer

Masterclass - Stibbe in Amsterdam organiseert op 6 juni de masterclass 'Alcohol- & drugstesten op de werkvloer'. Tijdens deze masterclass bespreken arbeidsrechtexpert Johan Zwemmer en privacydeskundigen Frederiek Fernhout en Judica Krikke het algemene verbod van de Autoriteit Persoonsgegevens op deze testen voor werkgevers en leggen zij onder meer uit hoe hiermee moet worden omgegaan.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring