Customer agreement

The organization should ensure, where relevant, that the contract to process PII addresses the organization’s role in providing assistance with the customer’s obligations (taking into account the nature of processing and the information available to the organization) ... - Licensed content not shown -

GDPR (EU)

28.3.e: Article(28)(3)(e): Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;

28.3.f: Article(28)(3)(f): Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor

28.9: Article(28)(9): The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.

35.1: Article(35)(1): Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

LGPD (BRA)

Art.39: The processor must carry out the processing of the data in accordance with the instructions provided by the controller, which will verify the observance of these instructions and rules on the matter.

Art.46: Processing agents must adopt security measures, both technical and administrative, suitable to protect personal data from unauthorized access and accidental or illegal destruction, loss, change, communication, or dissemination events, or any other occurrence resulting from inappropriate or illegal processing. § 1 The National Data Protection Authority may determine minimum technical standards for the purposes of the provisions this Article, considering the nature of the information processed, the specific. characteristics of the processing, and the current state of technology, especially in the case of sensitive personal data, as well as the principles outlined in Article 6 of this Law.§ 2 The measures contemplated in the head provision of this Article must be considered from the phase of the development of the good or service until its execution.

APP (Australian Privacy Principles)

APP.8.1: Before disclosing personal information to an overseas recipient, must take reasonable steps to ensure the overseas recipient does not breach the APPs (APP 8.1)

PIPEDA (Personal Information Protection and Electronic Documents Act) - Canada

4.1.3: Responsible for personal information that has been transferred to third parties for processing (4.1.3)

DPP (Data Protection Principles) - Hong Kong

DPP.2: The data user must adopt contractual or other means to prevent data from being kept by data processors longer than necessary Must take all practical steps to ensure personal data is not kept longer than necessary to fulfil the purpose for which it was collected Must take all practical steps to ensure personal data is accurate having regard to the purposes for which it is or is to be used Data user must adopt contractual provisions to prevent personal data being kept longer by data processor than necessary to fulfil the processing (DPP 2)

Personal Data Protection Act - Singapore

S.4.3: Organisations have the same obligations in respect of personal data processed for them by a 'data intermediary' as if it was processed by them (S.4(3))

Personal Information Protection Act - South Korea

A.26: On outsourcing the processing of personal information to a third party, must satisfy certain formalities in writing and prevent processing for purposes other than the purposes for which the processing was outsourced and ensure technical and managerial safeguards

Turkish Data Protection Law numbered 6698

A.12.2: Jointly responsible with processor to take all necessary technical and administrative measures to provide a sufficient level of security in order to (i) prevent unlawful...