Not named in the source

What happened

The Belgian DPA held that a data processing agreement cannot be applied retroactively, as this would allow for the circumvention of Article 28(3) GDPR. Moreover, the DPA clarified that both the controller and processor are responsible for concluding the data processing agreement.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subject12(1)Read →
• Art. 14Information to be provided where personal data have not been obtained from the data subject14(5)(c)Read →
• Art. 28Processor28(1) · 28(3)Read →

• Processor obligations
• Transparency