Category: Ch. IV – Controller and Processor

EU GDPR | Art. 24 Controller Responsibilities Article 24 Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural...

EU GDPR | Art. 25 Data Protection by design and by default Article 25 Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying...

EU GDPR | Art. 26 Joint Controllers Article 26 Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective...

EU GDPR | Art. 27 Representatives of controller or processors not established in the EU Article 27 Where Article 3(2) applies (EU Data Subjects data being processed by a non-EU entity), the controller or the processor shall...

EU GDPR | Art. 28 Processor Article 28 Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and...

EU GDPR | Art. 29 Processing under the authority of the controller or processor Article 29 The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not...

EU GDPR | Art. 30 Records of processing activities Article 30 Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility. That record shall...

EU GDPR | Art. 31 Cooperation with the supervisory authority Article 31 The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the...

EU GDPR | Art. 32 Security of processing Article 32 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and...

EU GDPR | Art. 33 Notification of a personal data breach to the supervisory authority Article 33 In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after...

EU GDPR | Art. 34 Communication of a personal data breach to the data subject Article 34 When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall...

EU GDPR | Art. 35 Data Protection Impact Assessment Article 35 Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to...