Q&As

What materials are available to assist with drafting variations to existing English law contracts between controllers and processors of personal data as necessary to comply with the GDPR?

read titleRead full title
Published on LexisPSL on 09/01/2018

The following Information Law Q&A provides comprehensive and up to date legal information covering:

  • What materials are available to assist with drafting variations to existing English law contracts between controllers and processors of personal data as necessary to comply with the GDPR?
  • Background
  • Guidance on varying agreement
  • Precedent GDPR compliant processing provisions for private sector controllers
  • Precedent provisions and guidance for public sector controllers
  • Other GDPR materials

What materials are available to assist with drafting variations to existing English law contracts between controllers and processors of personal data as necessary to comply with the GDPR?

Background

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679 will replace Directive 95/46/EC (Data Protection Directive) and all data protection legislation in EU Member States, including the UK’s Data Protection Act 1998 from 25 May 2018. The GDPR will be directly applicable in all Member States without the need for implementing national legislation. For further information, see Practice Notes: Introduction to the EU GDPR and UK GDPR and EU data protection reform—timeline [Archived].

Under the GDPR it will still be necessary for the controller to enter into a written agreement with the processor, but the GDPR is also more prescriptive as to what exactly that agreement must contain. Agreements relating to the sharing or processing of personal data which continue after 24 May 2018 therefore need to be amended to comply with the different requirements of the GDPR prior to it taking effect (and with preceding data protection law prior to that date).

Controllers should take steps to vary

Related documents:

Popular documents