If you share personal information with a data editor to perform a task, you should essentially have an agreement with that manager. Each company and trade agreement is different and your RGPD data processing agreement may vary depending on the type of data processing. However, some general clauses apply to most situations. The rules, including whether a company should have a data protection representative, have been criticized for the potential administrative burden and lack of clarity in compliance requirements. [67] Although data minimisation is a prerequisite, pseudonymization being one of the possible means, the regulation provides no indication as to the form or form of an effective data identification system, with a grey area considered insufficient pseudonymization, which is the subject of Section 5 enforcement measures. [68] [69] [70] There are also concerns about the transposition of the RGPD into blockchain systems, as the transparent and fixed recording of blockchain transactions is contrary to the nature of the RGPD. [71] Many media have commented on the introduction of a “right to explain” algorithmic decisions,[72] but legal experts have since argued that the existence of such a right without judicial testing is extremely unclear and, at best, limited. [74] [75] Like any contract, a data processing agreement is intended to ensure that all parties act appropriately and terminate their contract. Article 28, Section 3, details the eight themes that need to be addressed in a CCA. In summary, what you must include is that the regulation does not provide that the processing of personal data is subject to national security activities or EU criminal prosecution; However, industry groups dealing with a possible legal dispute have challenged the possibility of using Article 48[6] of the RGPD in order to prevent a person who is subject to third country legislation from complying with a legal order of the country`s law enforcement, judicial or national security authorities to transmit the personal data of an EU person to those authorities. , whether the data is in the EU or beyond. Article 48 stipulates that any judgment of a court and any decision by an administrative authority of a third country requiring a processing officer or subcontractor to transmit or disclose personal data cannot in any way be recognised or enforceable, unless there is an international agreement, such as a mutual legal assistance contract in force between the requesting third country (third country) and the EU or Member State.

[7] The data protection reform package also contains a separate data protection policy for the police and criminal law sectors[8], which contains rules on the exchange of personal data at national, European and international levels. What does my company need to do to ensure compliance? First, identify each relationship your company has with suppliers, customers, subcontractors or contractors, agents, resellers, distributors, etc., in which you provide them with personal data or in which you are dividing personal data.