Under the General Data Protection Regulation (GDPR), what must be included in a written agreement between the controller and processor in relation to processing conducted on the controller’s behalf?

Under the General Data Protection Regulation (GDPR), what must be included in a written agreement between the controller and processor in relation to processing conducted on the controller’s behalf?
A . An obligation on the processor to report any personal data breach to the controller within 72 hours.
B . An obligation on both parties to report any serious personal data breach to the supervisory authority.
C . An obligation on both parties to agree to a termination of the agreement if the other party is responsible for a personal data breach.
D . An obligation on the processor to assist the controller in complying with the controller’s obligations to notify the supervisory authority about personal data breaches.

View Answer

Answer: D

Explanation:

Under the GDPR, a written agreement between the controller and processor must include an obligation on the processor to assist the controller in complying with the controller’s obligations to notify the supervisory authority and the data subjects about personal data breaches. This is stated in Article 28(3)(f) of the GDPR1. The other options are not required by the GDPR, although they may be included in the agreement as additional clauses. The obligation to report any personal data breach to the controller within 72 hours is imposed on the processor by Article 33(2) of the GDPR1, not by the agreement. The obligation to report any serious personal data breach to the supervisory authority is imposed on the controller by Article 33(1) of the GDPR1, not by the agreement. The termination of the agreement in case of a personal data breach is not a mandatory provision under the GDPR, but rather a contractual matter that may depend on the circumstances and severity of the breach.

Reference: GDPR