This Practice Note introduces the requirements of the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) where a processor will process personal data on behalf of a controller in a commercial context. It assumes a degree of familiarity with key data protection concepts and terms and the role of key regulators. For a general introduction to EU GDPR, see Practice Note: The EU’s General Data Protection Regulation (EU GDPR). The requirements under the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) are outside the scope of this Practice Note. For more information about the requirements under the UK GDPR, see Practice Note: Supply chains under data protection law—arrangements between controllers and processors. In brief Data protection laws in the EEA (the EU plus Iceland, Norway, and Liechtenstein) seek to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly. To help ensure that, the EU GDPR (which applies in the EEA) imposes a large number of obligations on those ‘processing’ personal data (and on