Records related to processing PII

The organization should determine and maintain the necessary records in support of demonstrating compliance with its obligations (as specified in the applicable agreement) for the processing... ... - Licensed content not shown -

GDPR (EU)

30.2.a: Article(30)(2)(a): Each processor and, where applicable, the processor's representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer;

30.2.b: Article(30)(2)(b): Each processor and, where applicable, the processor's representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (b) the categories of processing carried out on behalf of each controller

30.3: Article(30)(3): The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.

30.4: Article(30)(4): The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request.

30.5: Article(30)(5): The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

LGPD (BRA)

Art.37: The controller and processor must record their personal data processing operations performed, especially when based on legitimate interest.

Art.39: The processor must carry out the processing of the data in accordance with the instructions provided by the controller, which will verify the observance of these instructions and rules on the matter.

Personal Data Protection Act - Singapore

S.4.2: Except for Ss.24-25, no obligations apply to a 'data intermediary' in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a written contract

Personal Information Protection Act - South Korea

A.26: On outsourcing the processing of personal information to a third party, must satisfy certain formalities in writing and prevent processing for purposes other than the purposes for which the processing was outsourced and ensure technical and managerial safeguards