Set by the law · GDPR Art. 28(3)
Data processing agreement
In plain English
The binding contract or other legal act between a controller and a processor that sets out what is processed, why, for how long, and the parties' obligations and rights.
The official text
Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.
197 decisions on Fino cite Article 28 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.