operation is carried out on behalf operation is carried out on behalf of and means of the processing controllers or where a processing (…) of a controller. a controller. jointly with other controllers or operation is carried out on behalf of The data subject where a processing operation is a controller. should have the right to exercise carried out on behalf of a his or her rights under this controller. Directive in respect of and against each of the joint controllers. (39a) The carrying out of (39a) The carrying out of processing processing by a processor should by a processor should be governed be governed by a legal act by a legal act including a contract including a contract binding the binding the processor to the processor to the controller and controller and stipulating, in stipulating in particular that the particular, that the processor should processor should act only on act only on instructions from the (…) instructions from the controller. controller. The processor should take into account the principle of data protection by design and by default. (40) Processing activities should be (40) Processing activities should be (40) Categories of personal data (40) In order to demonstrate documented by the controller or documented by the controller or processing activities including compliance with this Directive, the processor, in order to monitor processor, in order to monitor transfers by way of appropriate controller or processor should compliance with this Directive. compliance with this Directive. safeguards and in specific maintain records regarding all Each controller and processor Each controller and processor situations should be recorded by categories of personal data should be obliged to co-operate should be obliged to co-operate the controller and the processor, in processing activities under its with the supervisory authority and with the supervisory authority and order to monitor compliance with responsibility. Each controller and make this documentation available make this documentation available this Directive. Each controller and processor should be obliged to upon request, so that it might serve upon request, so that it might serve processor should be obliged to cooperate with the supervisory for monitoring processing for monitoring processing with the supervisory authority and make these records, on operations. operations. authority and make these records, request, available to it, so that it on request, available to it, so that it might serve for monitoring those might serve for monitoring processing operations. The processing operations. controller or the processor
operation is carried out on behalf of a controller. operation is carried out on behalf of a controller. The data subject should have the right to exercise his or her rights under this Directive in respect of and against each of the joint controllers. (…) and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller. controllers or where a processing operation is carried out on behalf of a controller. (39a) The carrying out of processing by a processor should be governed by a legal act including a contract binding the processor to the controller and stipulating in particular that the processor (…) should act only on instructions from the controller. (39a) The carrying out of processing by a processor should be governed by a legal act including a contract binding the processor to the controller and stipulating, in particular, that the processor should act only on instructions from the controller. The processor should take into account the principle of data protection by design and by default. (40) Processing activities should be documented by the controller or processor, in order to monitor compliance with this Directive. Each controller and processor should be obliged to co-operate with the supervisory authority and make this documentation available upon request, so that it might serve for monitoring processing operations. (40) Processing activities should be documented by the controller or processor, in order to monitor compliance with this Directive. Each controller and processor should be obliged to co-operate with the supervisory authority and make this documentation available upon request, so that it might serve for monitoring processing operations. (40) Categories of personal data processing activities including transfers by way of appropriate safeguards and in specific situations should be recorded by the controller and the processor, in order to monitor compliance with this Directive. Each controller and processor should be obliged to with the supervisory authority and make these records, on request, available to it, so that it might serve for monitoring processing operations. (40) In order to demonstrate compliance with this Directive, the controller or processor should maintain records regarding all categories of personal data processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make these records, on request, available to it, so that it might serve for monitoring those processing operations. The controller or the processor