Under the GDPR, Liem and EcoMick’s contract with MarketIQ must contain all of the following provisions EXCEPT?
A controller–processor contract under GDPR Article 28(3) must cover documented instructions for transfers outside the EEA, assistance with data protection impact assessments, and deletion or return of personal data when the services end. Notification of third-party requests to access the controllers’ personal data is not one of Article 28(3)’s specified mandatory contractual terms.
Community Discussion