CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ8

European Data Protection Law and Regulation

Under the GDPR, Liem and EcoMick’s contract with MarketIQ must contain all of the following provisions EXCEPT?

  • A Processing the personal data upon documented instructions regarding data transfers outside of the EEA.
  • B Notification regarding third party requests for access to Liem and EcoMick’s personal data.
  • C Assistance to Liem and EcoMick in their compliance with data protection impact assessments.
  • D Returning or deleting personal data after the end of the provision of the services.
Explanation

A controller–processor contract under GDPR Article 28(3) must cover documented instructions for transfers outside the EEA, assistance with data protection impact assessments, and deletion or return of personal data when the services end. Notification of third-party requests to access the controllers’ personal data is not one of Article 28(3)’s specified mandatory contractual terms.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!