EDPB Opinion 22/2024: obligations when relying on (sub-)processors
paid
–
8 min read
📚 You must list all (sub-sub-sub-sub...)processors (name, address, contact person, processing activity, roles & responsibilities) and always verify they've provided 'sufficient guarantees'—though the extent might vary based on risk—also for onwards transfers.
Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis
paid
–
4 min read
The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡
Denmark DPA reports controller to police and suggests DKK 1,5 m fine
paid
–
2 min read
💸 DKK 1,5m and reported to the police for not auditing their processors for 𝒚𝒆𝒂𝒓𝒔, violating the accountability principle.
Auditing your GDPR processors
paid
–
9 min read
The 🇩🇰 DPA's useful guidance on how to audit your processors, which you should do (and document) regularly!