# data[].attributes.headline
EDPB: Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)

# data[].attributes.subject
EDPB: Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)

# data[].attributes.attachment_link.title
Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)

# data[].attributes.attachment_link.description
The results indicated various differences between the nineteen Member States which took part in the coordinated inspection activity, enabling the CSC to draw conclusions and to recommend the necessary measures with regard to the documentation of the alerts, their quality, the time limits and retention period, as well as substantive and technical issues.

# data[].attributes.headline
EDPB: Guidelines 07/2020 on the concepts of controller and processor in the GDPR

# data[].attributes.subject
EDPB: Guidelines 07/2020 on the concepts of controller and processor in the GDPR

# data[].attributes.attachment_link.title
Guidelines 07/2020 on the concepts of controller and processor in the GDPR | European Data Protection Board

# data[].attributes.attachment_link.description
The members of the Schengen Information System II Supervision Coordination Group (SIS II SCG) and the Coordinated Supervision Committee (CSC) conducted a coordinated inspection activity concerning the Schengen Information System (SIS). The SIS is the most widely used and largest information sharing system for security and border management in Europe.

# data[].attributes.headline
EC: Standard contractual clauses for controllers and processors in the EU/EEA

# data[].attributes.subject
EC: Standard contractual clauses for controllers and processors in the EU/EEA

# data[].attributes.attachment_link.readable_text
ANNEX

Standard contractual clauses

SECTION I

Invariability of the Clauses

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5 - Optional

SECTION II

OBLIGATIONS OF THE PARTIES

Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Obligations of the Parties

7.1. Instructions

7.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences ("sensitive data"), the processor shall apply specific restrictions and/or additional safeguards.

7.6. Documentation and compliance

7.7. Use of sub-processors

OPTION 1: PRIOR SPECIFIC AUTHORISATION: The processor shall not subcontract any of its processing operations performed on behalf of the controller in accordance with these Clauses to a sub-processor, without the controller's prior specific written authorisation. The processor shall submit the request for specific authorisation at least [SPECIFY TIME PERIOD] prior to the engagement of the sub-processor in question, together with the information necessary to enable the controller to decide on the authorisation. The list of sub-processors authorised by the controller can be found in Annex IV. The Parties shall keep Annex IV up to date.

OPTION 2: GENERAL WRITTEN AUTHORISATION: The processor has the controller's general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least [SPECIFY TIME PERIOD] in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.

7.8. International transfers

Assistance to the controller

In addition to the processor's obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679 or under Articles 34 and 35 of Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

in obtaining the following information which, pursuant to [OPTION 1] Article 33(3) of Regulation (EU) 2016/679/ [OPTION 2] Article 34(3) of Regulation (EU) 2018/1725, shall be stated in the controller's notification, and must at least include:

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

9.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller's obligations under [OPTION 1] Articles 33 and 34 of Regulation (EU) 2016/679 / [OPTION 2] Articles 34 and 35 of Regulation (EU) 2018/1725.

SECTION III

FINAL PROVISIONS

Non-compliance with the Clauses and termination

The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

# data[].attributes.attachment_link.title
Implementing decision - 2021/915 - EN - EUR-Lex

# data[].attributes.attachment_link.description
COMMISSION IMPLEMENTING DECISION (EU) 2021/915

# data[].attributes.headline
EC: Standard contractual clauses for international transfers

# data[].attributes.subject
EC: Standard contractual clauses for international transfers

# data[].attributes.attachment_link.title
Standard contractual clauses for international transfers

# data[].attributes.attachment_link.description
Modernised standard contractual clauses for the transfer of personal data to third countries