Search every question across sub-FAQs

The record should be specific enough to show why the SCCs work for this transfer. Under Clause 14, the parties take due account of the transfer's circumstances, relevant destination-country laws and practices, and safeguards that supplement the clauses. The importer should provide relevant information and continue cooperating with the exporter.

The evidence file should also preserve the operational result: whether the transfer can proceed, which supplementary safeguards were adopted, which public-authority request notices or transparency limits apply, and what event will reopen the assessment.

Supplementary measures are needed when the Clause 14 assessment is negative or shows that the SCCs alone may not ensure the required protection. The measures can be contractual, technical, or organisational, but they must actually address the identified gap for the specific transfer.

If the exporter receives an importer notice, learns that the importer can no longer comply, or concludes that no appropriate safeguards can be ensured, the transfer should be suspended. The SCCs also provide termination and return-or-delete mechanics when compliance is not restored.

A controller is the party that determines why personal data is processed and the essential means of that processing. A processor is a separate party that processes personal data on behalf of the controller and must not use the data for its own purposes outside the controller's instructions.

The EDPB treats the concepts as functional: the analysis should follow the actual role each party plays in the specific processing operation. Contract wording helps, but it is not enough if the operational facts show that a party decides purposes or essential means. Union or Member State law can also determine the controller or set the criteria for nominating one.

Article 28 applies when processing is carried out on behalf of a controller. The controller must use only processors that provide sufficient guarantees for appropriate technical and organisational measures, and the processing must be governed by a binding contract or other legal act.

The Article 28 record should identify the subject matter, duration, nature, purpose, personal-data types, data-subject categories, obligations and rights of the controller, and the concrete processor duties that make the instructions operational. A generic data-processing addendum may not supply that detail. If a processor goes beyond the controller's instructions and determines the purposes and means, Article 28(10) treats it as a controller for that processing, without excusing the departure from the contract or instructions.

Joint controllership exists where two or more parties jointly determine the purposes and means of the same processing. The EDPB explains that joint participation may come from a common decision or from converging decisions that complement each other and are necessary for the processing in a way that has a tangible impact on purposes and means.

Article 26 requires joint controllers to transparently determine their respective GDPR responsibilities by arrangement, especially for data-subject rights and Articles 13 and 14 information duties. The essence of that arrangement must be made available to data subjects, and data subjects may exercise their rights against each joint controller.

Keep evidence at processing-activity level. A useful role file shows the purpose, essential means, party responsibilities, instructions, contract or arrangement, relevant records of processing, and the trigger for reassessing the label.

Article 30 records support this work. Where the recordkeeping duty applies, controllers must record processing activities under their responsibility, while processors must record categories of processing carried out on behalf of each controller. Article 30(5) provides a limited exception for an enterprise or organisation employing fewer than 250 persons only where the processing is unlikely to result in a risk to people's rights and freedoms, is occasional, and does not include Article 9 special-category or Article 10 criminal-offence data. RoPA entries should preserve the controller, processor, joint-controller, and subprocessor distinctions instead of collapsing every party into a vendor list.

A DPIA is mandatory when the planned processing is likely to result in a high risk to individuals. Article 35 says the controller must assess the impact before the processing starts, especially where new technologies are used and the nature, scope, context, and purposes of the operation make the risk high.

Article 35(3) gives three cases where a DPIA is required in particular: systematic and extensive automated evaluation, including profiling, that produces legal or similarly significant effects; large-scale processing of special-category data or criminal-offence data; and large-scale systematic monitoring of a publicly accessible area.

Start with the three Article 35(3) cases, then test the broader WP29 high-risk criteria: evaluation or scoring, automated decisions with legal or similarly significant effects, systematic monitoring, sensitive or highly personal data, large scale, matched or combined datasets, vulnerable people, innovative technology or organisational solutions, and processing that prevents people from exercising a right or using a service or contract.

The criteria screen for Article 35's likely-high-risk test. WP29 says meeting two criteria will usually indicate that a DPIA is required, while some processing may require one after meeting only one criterion. A controller that concludes two or more criteria do not create likely high risk should document its reasons and include the DPO's views where a DPO is designated.

Article 35(4) requires each supervisory authority to establish and publish a list of processing operations that are subject to the DPIA requirement, and Article 35(5) allows a supervisory authority to publish a list of operations for which no DPIA is required. Use those lists as a jurisdiction-specific check only where the relevant list is actually available and applicable to the processing operation.

Do not treat a general guidance page, sector label, vendor statement, or non-applicable national list as an exemption. If a no-DPIA list is used, the decision should explain why the processing falls strictly within the listed procedure and continues to meet the relevant requirements.

If the threshold is met, Article 35(7) requires the DPIA to contain at least four elements: a systematic description of the envisaged processing and purposes, an assessment of necessity and proportionality, an assessment of risks to data subjects' rights and freedoms, and the measures envisaged to address those risks and demonstrate GDPR compliance.

CNIL's PIA methodology maps those elements into practical records: context and processing description; fundamental-principles analysis covering purpose, lawfulness, minimization, storage, information, rights, processors, and transfers; privacy-risk analysis; and formal validation involving DPO advice and, where appropriate, views of data subjects or their representatives.

Do not start the Article 33 clock from every raw security alert. The EDPB says a controller becomes aware when it has a reasonable degree of certainty that a security incident has occurred and has led to personal data being compromised.

The controller must use that short investigation period promptly to establish whether personal data was breached, contain the incident, assess risk to individuals, and notify the supervisory authority if Article 33 is triggered. A personal data breach can affect confidentiality, integrity, or availability, so confirmed loss or destruction can trigger awareness even when unauthorized access has not been proved.

A processor that becomes aware of a personal data breach affecting personal data processed for a controller must notify the controller without undue delay. The processor does not decide the Article 33 risk threshold for the controller before escalating.

Once the processor informs the controller, the controller uses that notice to run the Article 33 assessment and, if required, notify the supervisory authority. The EDPB says the controller should in principle be considered aware once the processor has informed it of the breach. The controller keeps legal responsibility for notification even if a processor is authorised to submit a notice on its behalf.

The GDPR allows notification information to be provided in phases when it is not possible to provide all information at the same time. Exact counts are not a condition for the first notice: Article 33 allows approximate numbers of affected data subjects and records where possible. The first notice should say what is known, what is not yet known, and that more information will follow without undue further delay.

If the supervisory-authority notification is not made within 72 hours after awareness, Article 33 requires reasons for the delay. Those reasons should be specific to the breach, such as why facts could not be established sooner or why a bundled notification was used for closely related breaches.

Article 33(5) requires the controller to document personal data breaches, including the facts, effects, and remedial action. The record must allow a supervisory authority to verify compliance with Article 33.

Keep records for both notifiable and non-notifiable breaches. If the controller decides not to notify, the record should explain why the breach was unlikely to result in risk to individuals. If data subjects are not told despite likely high risk, the record should support one of Article 34(3)'s conditions: effective prior protection such as unintelligible encryption, later measures that make the high risk no longer likely to materialise, or disproportionate effort coupled with an equally effective public or similar communication.