Module 3

Question 1

Controller

Answer 1

Article 4(7): ‘the natural or
legal person, public authority,
agency or other body which,
alone or jointly with others,
determines the purposes and
means of the processing of
personal data’

Middelen delegeren mag; doelen stelt
de verantwoordelijke vast

Question 2

Joint controllers

Answer 2

Where two or more
controllers jointly determine
the purposes and means of
processing, they shall be
joint controllers.
(Article 26)

Question 3

Processor

Answer 3

Article 4(8): ‘a natural or legal
person, public authority,
agency or other body which
processes personal data on
behalf of the controller’

Question 4

Processor as controller

Answer 4

If a processor infringes this
Regulation by determining
the purposes and means of
processing, the processor
shall be considered to be a
controller in respect of that
processing (Article 28)

Question 5

Vendor management

Answer 5

• Choose reliable processors
• Maintain quality control and
  compliance throughout the
  duration of the arrangements
• Frame the relationship in a
  contract (or other legally
  binding act)

Question 6

Engaging processors - Precontractual duediligence

Answer 6

• Appropriate technical and organisational measures to secure data
• Processor’s data protection knowledge
• Recent high profile breaches
• Under investigation?
• Accreditation
• Processor’s policy framework
• Sub-processors

Question 7

Engaging processors - Components of a contract

Answer 7

Article 28
- Subject matter, duration and nature of the data processing
- Types of personal data and categories of data subjects
- Obligations and rights of the controller
- The processor’s responsibilities

Question 8

Engaging processors - Contractual terms

Answer 8

• Process on documented instructions only
• Ensure confidentiality
• Implement appropriate security
• Get controller’s consent to engage processors
• Assist with data breach notifications
• Delete or return personal data
• Assist the controller in providing for data subject rights
• Demonstrate GDPR compliance
• Contribute to audits, including inspections

Question 9

Soorten overeenkomst

Answer 9

• Verwerkersovereenkomst (verantwoordelijke en verwerker)
• Subverwerkersovereenkomst (verwerker en subverwerker)
• Data-uitwisselovereenkomst (verantwoordelijke en
  verantwoordelijke)
• Andere ‘onderlinge regeling’ (zelfstandige
  verantwoordelijkheid)

Question 10

True or false: A data controller
may be a natural person or a
legal entity, while a data
processor must be a legal
entity

Answer 10

False: Verwerker en verantwoordelijke kunnen zowel natuurlijk persoon als rechtspersoon zijn.

Question 11

True or false: A contract protects a processor from being held to the same legal obligations as the controller.

Answer 11

False

Question 12

True or false: A processor may decide where and how to process personal data.

Answer 12

False