The UK’s Information Commissioner’s Office (ICO) published a Consultation on GDPR guidance on contracts and liabilities between controllers and processors.
The guidance reminds that the GDPR builds on the existing requirement of principle 7 of the DPA (security measures) to have a written contract in place between a controller and processor. The GDPR requires much more; it specifies the detailed terms such a contract must contain with the aim of setting high standards and protecting the interests of data subjects.
Processors have new responsibilities and liabilities in their own right under the GDPR. Both controllers and processors may now be liable to pay damages or be subject to significantly increased fines or penalties.
The draft guidance on contracts and liabilities explains:
- to controllers, what they must include in contracts; and
- sets out what responsibilities and liabilities processors haveunder the GDPR.
Find out more about the guidance and ICO’s consultation here.
ICO is UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.