A processing agreement on the processing of personal data

Processing agreement

A processing agreement is a special agreement on the processing of personal data. The parties to the agreement are the controller and the processor on the one hand.

The processing agreement must be written and must meet certain conditions according to the Data Protection Act.

The agreement must include, among other things:

• subject and duration of the processing,

• its nature and purpose,

• the type of personal data and categories of individuals registered;

• as well as the obligations and rights of the controller.

• In addition, the contract must stipulate that the processor only processes personal data in accordance with the controller's documented instructions, unless otherwise specified in law.

The processing agreement shall also address:

• the confidentiality of those who process the personal data,

• authorisations to hire subprocessors,

• the processing of the personal data at the end of the contractual relationship and other matters.