Who is responsible for putting a GDPR Article 28 Data Processing Agreement in place?
Dutch Data Protection Authority, Autoreitpersoonsgegevens, says: BOTH the data controller and the data processor.
- As a controller, you are in violation if you cooperate with a processor but have not made any written agreements on this. In that case, you cannot prove that you have sufficient guarantees that that other organization protects the personal data in accordance with the rules of the GDPR.
- As a processor you are also required to have a processor agreement. Otherwise, you cannot rely on the responsible person’s basis. You then have no right to process that personal data.
- When assessing a processing, the Dutch Data Protection Authority always looks at the actual situation. If a party actually determines the purposes and means of the data processing, it will be deemed a data controller even if the data processing agreement calls that party a data processor.