Aithris 81
Recital 81
(81) Chun comhlíonadh cheanglais an Rialacháin seo a áirithiú i dtaca leis an bpróiseáil atá le déanamh ag an bpróiseálaí thar ceann an rialaitheora, nuair a chuirtear gníomhaíochtaí próiseála ar iontaoibh próiseálaí, níor cheart don rialaitheoir ach próiseálaithe a thugann ráthaíochtaí leordhóthanacha a úsáid, go háirithe ó thaobh saineolais, iontaofachta agus acmhainní, chun bearta teicniúla agus eagraíochtúla a chur chun feidhme sa dóigh is go gcomhlíonfar ceanglais an Rialacháin seo, lena n-áirítear maidir le slándáil na próiseála.
Má chloíonn próiseálaí le cód formheasta iompair nó le sásra formheasta deimhniúcháin, féadfar a thaispeáint leis sin go bhfuil oibleagáidí an rialaitheora á gcomhlíonadh.
Ba cheart an phróiseáil a dhéanann próiseálaí a rialú le conradh nó le gníomh dlíthiúil éigin eile faoi dhlí an Aontais nó faoi dhlí Ballstáit a cheanglaíonn an próiseálaí leis an rialaitheoir, ina leagtar amach ábhar agus fad na próiseála, cineál agus críocha na próiseála, cineál na sonraí pearsanta agus catagóirí na n-ábhar sonraí do na sonraí, agus cúraimí agus freagrachtaí sonracha an phróiseálaí á gcur san áireamh i gcomhthéacs na próiseála atá le cur i gcrích agus an riosca atá ann do chearta agus do shaoirsí an ábhair sonraí.
Féadfaidh an rialaitheoir agus an próiseálaí an rogha a dhéanamh úsáid a bhaint as conradh aonair nó clásail chaighdeánacha chonarthacha a ghlacfaidh an Coimisiún go díreach nó a ghlacfaidh údarás maoirseachta i gcomhréir leis an sásra comhsheasmhachta agus a ghlacfaidh an Coimisiún ina dhiaidh sin.
Tar éis an phróiseáil a thabhairt chun críche thar ceann an rialaitheora, ba cheart don phróiseálaí, ar rogha an rialaitheora, na sonraí pearsanta a thabhairt ar ais nó a scriosadh, mura gceanglaítear, faoi dhlí an Aontais nó faoi dhlí Ballstáit a bhfuil an próiseálaí faoi réir, na sonraí pearsanta a stóráil.
(81) To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing.
The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller.
The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk to the rights and freedoms of the data subject.
The controller and processor may choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by a supervisory authority in accordance with the consistency mechanism and then adopted by the Commission.
After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.