THE PROCESSOR’S OBLIGATIONS. 3.1 The Processor shall only process personal data on behalf of the Controller and under the terms stated in the Agreement or provided that documented instructions are available from the Controller, see section 4 below.
THE PROCESSOR’S OBLIGATIONS. The processor shall only process personal health data in accordance with instructions from the controller. Each of the clauses must be specified and elaborated on insofar is necessary and relevant in the appendices to the agreement.
THE PROCESSOR’S OBLIGATIONS. The Processor shall only Process Personal Data to the extent necessary to fulfill its obligations towards The Controller (The Client) under the SLA and for the purposes mentioned in section 1 above. Furthermore, The Processor may Process Personal Data on instructions from the Controller and strictly in accordance with such instructions, unless such instructions violates any provision in the Regulation and/or national applicable data protection legislation.
THE PROCESSOR’S OBLIGATIONS. The Processor shall comply with the procedures and instructions for the processing, which the Controller has decided is applicable at any given time. The Processor is obliged to provide the Controller with access to its security documentation, and assist the Controller with complying with their own responsibilities under the applicable personal data legislation, hereunder the GDPR. The Controller has, unless otherwise agreed or provided by law, the right to access and inspect the personal data processed and the systems used for this purpose. The Processor is obliged to provide necessary assistance to this. The Processor has a duty of confidentiality regarding documentation and personal data that they obtain access to pursuant to this DPA. This provision also applies after the DPA’s termination. The Processor shall ensure that persons authorized to process the personal data are committed to processing the information confidentially by a confidentiality statement in an employment contract or in other agreement with the Processor, if such person is not subject to an appropriate statutory duty of confidentiality. The Processor shall undertake necessary technical and organizational measures to achieve a level of security appropriate to the risks associated with processing of personal data and to ensure that the processing meets the requirements of applicable data protection legislation, including the requirements of the GDPR, and the protection of the rights of the data subject. The Processor shall assist the Controller with fulfilling the Controller’s duty to respond to requests from data subjects for the purpose of exercising his/her rights as a data subject. The Processor shall assist the Controller in ensuring compliance with the Controller’s obligations pursuant to GDPR articles 32 through 36. The Processor shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes the GDPR or other statutory provisions on the protection of personal data. The Processor shall keep a record over all the categories of processing activities which are performed on behalf of the Controller, in accordance with the GDPR article 30(2).
THE PROCESSOR’S OBLIGATIONS. 3.1 The Processor shall comply with the obligations that are stipulated in the GDPR and other applicable data protection legislation, as well as this Data Processing Agreement.
THE PROCESSOR’S OBLIGATIONS. The Processor shall ensure that persons authorised to process personal data on behalf of the Controller have undertaken to observe confidentiality or are subject to an appropriate statutory obligation of secrecy – whether or not they are the Processor’s employees or external service providers. The Processor shall ensure that persons authorised to process personal data on behalf of the Controller do not process such data without being instructed to do so by the Controller, unless required to do so by EU or member state law. The Processor shall, on request, assist the Controller with reporting breaches of personal data security to the competent supervisory authorities when the Controller is obliged to do so. At the Controller’s request, the Processor shall assist the Controller, as far as this is possible, with the fulfilment of the Controller’s obligation to respond to requests for exercising the data subjects’ rights as set out in the Personal Data Protection Act and the General Data Protection Regulation. The Processor shall, on request, assist the Controller with reporting breaches of personal data security to the data subjects when the Controller is obliged to do so. The Processor shall, on request, assist the Controller from 25 May 2018 with carrying out impact assessments for the agreed services when the Controller is obliged to do so. The Processor shall, on request, assist the Controller with preliminary consultation of competent supervisory authorities when an impact assessment shows that processing will entail a high risk which the Controller will not be able to limit by taking appropriate measures.
THE PROCESSOR’S OBLIGATIONS. 7.1. The Processor shall only process the Personal Data on behalf of the Controller and on written instructions from the Controller, and for the sole purpose and to the extent necessary to provide the Services, in accordance with the terms in this Agreement and Applicable Laws.
THE PROCESSOR’S OBLIGATIONS. 3.1 When processing Personal Data on behalf of the Controller, the Processor shall follow the routines and instructions given by the Controller at any given time.
THE PROCESSOR’S OBLIGATIONS. 4.1 The Processor will only process the Personal Data to the extent, and in such a manner, as is necessary for the Agreed Purposes in accordance with the Controller’s written instructions. The Processor will not process the Personal Data for any other purpose or in a way that does not comply with this agreement or the Data Protection Legislation.
THE PROCESSOR’S OBLIGATIONS. 4.1 Technical and organisational security measures
