The U.K. Information Commissioner's Office (ICO) recently
published guidance on contracts between controllers and
processors. This new guidance provides a more in-depth and detailed
discussion of the key issues than did a previously released primer published by the ICO, which set out key
points along with helpful checklists.
The new guidance discusses (1) when a contract is needed and
why, (2) specifically what terms need to be included in the
contract, (3) the responsibilities and liabilities of controllers
when using a processor, and (4) the responsibilities and
liabilities of processors.
The guidance lays out the minimum required terms, citing to the
Articles of the General Data Protection Regulation (GDPR), and
provides some color on the following terms and clauses: (1)
processing only on the documented instructions of the controller;
(2) duty of confidence; (3) appropriate security measures; (4)
using sub-processors; (5) data subjects' rights; (6)
