11.1 The subcontractor may not transfer or authorize the transfer of data to countries outside the EU and/or the European Economic Area (EEA) without the company`s prior written consent. When personal data processed under this agreement is transferred from a country within the European Economic Area to a country outside the European Economic Area, the parties ensure that personal data is adequately protected. To do so, contracting parties, unless otherwise agreed, rely on standard contractual clauses approved by the EU for the transfer of personal data. In order to help our customers, we have established a model confidentiality agreement that can be used in addition to existing agreements. Processors should have carried out a number of due diligence activities involving the transformers they use, which can be grouped together as data protection verification, documentation of data processing activities and obvious verification. The RGPD is very specific to the tasks of the person in charge of the processing and the subcontractor, and Article 28, paragraph 3, of the RGPD stipulates that there must be a written contract between the processing manager and the subcontractor, which clearly defines the purpose of the processing and its duration, as well as the nature and purpose of the processing, the types of personal data, the particular categories of data and the obligations and rights of both parties. Definition by RGPD When a data publisher processs on behalf of a processing manager, the processing manager does not comply with the RGPD unless there is a written contract between the two parties, the following clauses: The RGPD applies to both processing managers and subcontractors, established in the EU (for example. B through EU legal entities), but also for all processing managers and subcontractors who are not established in the EU, where processing activities are linked either to the provision of goods or services to the persons concerned in the EU (whether payment is necessary) or to monitoring the behaviour of individuals to the extent that such behaviour takes place within the EU. The Information Governance Team also has other data processing agreements that, in certain circumstances, can be used, including a short-form agreement. Since processors and processors are also required to comply with the RGPD, international data transfers should provide appropriate solutions for the transfer of personal data from the EU or, more correctly, to other european Economic Area jurisdictions. 8. The data protection impact analysis and the data protection subcontractor provide the company with appropriate support for all data protection impact assessments and prior consultations with supervisory authorities or other data protection authorities; that the company considers reasonably necessary in accordance with section 35 or 36 of the RGPD or equivalent provisions of another data protection law, in any case only with respect to the processing of the company`s personal data by contract processors and taking into account the nature of the processing and information available to processors.
☐ given the nature of the processing and the information available, the subcontractor assists the processing manager in carrying out his RGPD obligations with respect to processing security, notification of personal data breaches and data protection impact analyses; When a subcontractor uses another organization (i.e. a subcontractor) to help process personal data for a processing manager, it must have a written contract with that subcontractor. Other provisions of this data processing agreement govern liability and compensation and have been written in this case to strike a balance between the processor and the data processor.