Monitoring rights of the Controller Clause Samples
The 'Monitoring rights of the Controller' clause grants the data controller the authority to oversee and verify the data processing activities carried out by the data processor. This typically includes the right to conduct audits, request documentation, or access facilities where personal data is processed to ensure compliance with data protection obligations. By establishing these rights, the clause helps ensure transparency and accountability, allowing the controller to confirm that data is handled appropriately and in accordance with legal and contractual requirements.
Monitoring rights of the Controller. 8.1 The Controller has the right, after consultation with the Processor, to carry out inspections or to have them carried out by an auditor to be designated in each individual case. The Controller has the right to convince itself of the compliance with this Agreement by the Processor in its business operations by means of random checks, which are to be announced in advance with good time. These rights of the Controller shall not extend to facilities which are operated by sub- processors, sub-contractors or any third parties which the Processor may use to attain its Purpose and provide its Services. The Processor shall ensure that the Processing activities carried out by any sub-processors, sub-contractors or any third parties which the Processor may use to attain its Purpose and provide its Services meet the requirements laid down in this Agreement and in Applicable Law.
8.2 The Processor shall ensure that the Controller is able to verify compliance with the obligations of the Processor in accordance with the Applicable Laws. The Processor undertakes to provide to the Controller all necessary information on request and, in particular, to demonstrate the execution of the technical and organizational measures as mentioned in Schedule 2 within a reasonable timeframe.
8.3 Evidence of the implementation of any measures in this regard may also be presented in the form of up-to-date attestations, reports or extracts thereof from independent bodies (e.g. external auditors, internal audit, the data protection officer, the IT security department or quality auditors) or suitable certification by way of an IT security or data protection audit or by other measures provided by law.
Monitoring rights of the Controller. (1) After giving due notice, the Controller shall be entitled, at its own expense and during normal business hours, without disrupting the Processor’s business operations or endangering the security measures for other controllers, to monitor compliance with the data protection regulations and the contractual agreements to the necessary extent, either itself or using third parties. Such monitoring may also be carried out by means of access to the Processor’s industry-standard certifications, up-to-date certificates, or reports from independent bodies (such as an accountant, external data protection officer, auditor or external data protection auditor) or self-disclosures. The Processor shall provide the necessary assistance to carry out monitoring.
(2) The Processor shall inform the Controller of any monitoring measures implemented by the supervisory authority, insofar as the measures may involve data processing that the Processor performs for the Controller.
Monitoring rights of the Controller. The Controller shall be entitled, after prior notification in good time and during normal business hours, to carry out an inspection of compliance with the provisions on data protection and the contractual agreements to the extent required, either himself or through third parties, without disrupting the Processor's business operations or endangering the security measures for other Controller and at his own expense. Controls can also be carried out by accessing existing industry-standard certifications of the Processor, current attestations or reports from an independent body (such as auditors, external data protection officers or external data protection auditors) or self-assessments. The Processor shall offer the necessary support to carry out the checks.
Monitoring rights of the Controller. (1) The Controller shall at all times be entitled to monitor compliance with the provisions on data protection and the contractual agreements to the extent necessary, and may perform the inspections itself or using third parties, in particular by obtaining information and inspecting the stored data and systems as well as other on-site checks. The Parties shall agree on the time of the inspection or auditing and other details ahead of time and at latest fourteen (14) days before the inspection. The auditing shall be carried out in a way that does not impede the obligations of Processor or its subcontractors in regard to third parties. The representatives of the Controller and the auditor must sign conventional non-disclosure commitments.
(2) The Processor will assist the Controller in carrying out inspections and contribute to the complete and speedy processing of the inspections. Controller shall be responsible for its own and Processor’s expenses caused by the auditing.
(3) The Processor shall be obliged to provide the Controller with information insofar as this is necessary for carrying out the inspection.
Monitoring rights of the Controller. The controller has the right to carry out the checks envisaged in Art. 28 Para. 3 Sub-Para. 1 point h) GDPR – including inspections - or to arrange to have them carried out by examiners who are to be appointed on a case-by-case basis. It shall be entitled to ensure the processor is complying with the provisions of this agreement in its business by conducting random checks that must generally be announced in good time. The processor agrees to make the relevant evidence available and give the controller any information it requests and requires to fulfill its obligation to control data processing contracts. With regard to the monitoring obligations in respect of the controller, the processor shall make sure the controller is able to monitor the implementation of the agreed technical and organisational measures to fulfil the monitoring obligations to be assumed by the controller in accordance with point
Monitoring rights of the Controller. The Processor agrees that the Controller or a person commissioned by the Controller shall be entitled to monitor compliance with the provisions on data protection and the contractual agreements to the necessary extent, in particular by obtaining information and requesting relevant documents or access to the Processor's offices during the designated business hours after prior notification. Appropriate and valid IT security certificates (e.g. IT-Grundschutz, ISO 27001) can also provide proof of proper processing, provided that the respective object of the certification also applies to data processing on behalf in a specific case. However, providing a relevant certificate does not waive the obligation of the Processor to document the security measures within the meaning of Section 3 of this Agreement.
Monitoring rights of the Controller. The Controller may carry out control visits and/or audits on the Processor’s business premises before the start of the Processing and in regular intervals thereafter in order to verify compliance of the technical and organizational measures implemented by the Processor with the Agreement or appoint auditors to do so.
Monitoring rights of the Controller. 7.1 The Controller has the right, after consultation with the Processor, to carry out inspections or to have them carried out by an auditor to be designated in each individual case. The Processor agrees to contribute to such inspections and reserves the right to invoice the Controller for any reasonable costs incurred by the Processor in contributing to such inspections.
7.2 The Processor shall ensure that the Controller is able to verify compliance with the obligations of the Processor in accordance with Applicable Law. The Processor undertakes to provide to the Controller all necessary information on request within a reasonable timeframe.