导航
GDPR > 第 28 條. 處理者
下载PDF

第 28 條 GDPR. 處理者

Article 28 GDPR. Processor

1. 處理係由控管者之代表所為者,控管者應僅得任用提供充足保證會實施適當之科技化且有組織的措施、使處理符合本規則要求、並確 保資料主體權利保障之處理者。

1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

2. 未經控管者事先個案或一般書面授權者,處理者不得與其它處理 者相交涉。在一般書面授權情況下,處理者應通知控管者關於增加或 替換其他處理者之任何預期變化,從而給予控管者對該等變化提出異 議之機會。

2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraphs to article 28(2) GDPR:

8.5.6 Disclosure of subcontractors used to process PII

Control

The organization should disclose any use of subcontractors to process PII to the customer before use.

Implementation guidance

Provisions for the use of subcontractors to process PII should be included in the customer contract.


访问全文

3. 處理者所為處理應受契約或歐盟法或會員國法之其他立法之拘束, 該等規定對於處理者及控管者具有拘束力,並規定處理標的及處理期 間、處理之本質與目的、個人資料之類型及資料主體之類別以及控管 者之義務及權利。該契約或其他立法尤其應規定處理者:

3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor:

(a) 僅得依據控管者之書面指示處理個人資料,包括移轉個人資料至第三國或國際組織,但處理者受拘束之歐盟法或會員國法要求其應為 者不在此限;於此情形,除法律基於公共利益之重要理由禁止提供資 訊者外,處理者於處理前應通知控管者該法定要求;

(a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 28(3)(a) GDPR:

8.2.2 Organization’s purposes

Control

The organization should ensure that PII processed on behalf of a customer are only processed for the purposes expressed in the documented instructions of the customer.

Implementation guidance

The contract between the organization and the customer should include, but not be limited to, the objective and time frame to be achieved by the service.


访问全文

(b) 確保被授權處理個人資料之人已承諾保密或具備適當之法定保 密義務;

(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 13.2.4.

Here is the relevant paragraph to article 28(3)(b) GDPR:

6.10.2.4 Confidentiality or non-disclosure agreements

Implementation guidance

The organization should ensure that individuals operating under its control with access to PII are subject to a confidentiality obligation. The confidentiality agreement, whether part of a contract or separate, should specify the length of time the obligations should be adhered to.


访问全文

(c) 依第 32 條規定採取所有必要之保護措施;

(c) takes all measures required pursuant to Article 32;

相关文章

(d) 遵守第 2 項及第 4 項所定任用其它處理者之要件;

(d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 28(3)(d) GDPR:

8.5.7 Engagement of a subcontractor to process PII

Control

The organization should only engage a subcontractor to process PII according to the customer contract.

Implementation guidance

Where the organization subcontracts some or all of the processing of that PII to another organization, a written authorization from the customer is required prior to the PII processed by the subcontractor. This can be in the form of appropriate clauses in the customer contract, or can be a specific “one-off” agreement.

 


访问全文

(e) 考量到處理之本質,以適當之科技化且有組織的措施,在可能之 情況下,協助控管者履行其回應資料主體行使第三章所定權利之請求 之義務;

(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 28(3)(e) GDPR:

8.3.1 Obligations to PII principals

Control

The organization should provide the customer with the means to comply with its obligations related to PII principals.

Implementation guidance

A PII controller’s obligations can be defined by legislation, by regulation and/or by contract. These obligations can include matters where the customer uses the services of the organization for implementation of these obligations.


访问全文

(f) 考量到處理之本質及處理者可知資訊,協助控管者確保遵守第 32 條至第 36 條所定之義務;

(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;

相关文章

(g) 在提供與處理有關之服務結束後,依控管者之選擇,向控管者刪 除或移轉所有個人資料,並刪除現有副本,但歐盟法或會員國法要求 儲存該等個人資料者,不在此限;

(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 28(3)(g) GDPR:

8.4.2 Return, transfer or disposal of PII

Control

The organization should provide the ability to return, transfer and/or disposal of PII in a secure manner. It should also make its policy available to the customer.

Implementation guidance

At some point in time, PII can need to be disposed of in some manner. This can involve returning the PII to the customer, transferring it to another organization or to a PII controller (e.g. as a result of a merger), deleting or otherwise destroying it, de-identifying it or archiving it.


访问全文

(h) 向控管者提供證明遵守本條所定義務所需之一切資訊,並允許及 促進由控管者或控管者委任之其他審計師進行查核,包括檢查。

(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

ISO 27701

關於第一款第 h 點,如處理者認為某指令是否違反本規則或其他歐盟 或會員國資料保護規定者,應立即通知控管者。

With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

4. 當處理者代表控管者與他處理者聯合進行特定之處理活動時,第 3 項所定控管者與處理者間之契約或其他立法規定之相同資料保護義 務,應透過契約或歐盟法或會員國法所定之其他立法,使他處理者亦有其適用,尤其是提供充分保證其將實施適當之科技化且有組織的措 施,使其處理符合本規則之要求。如他處理者未能履行其資料保護義 務,則原處理者應就他處理者義務之履行對控管者負完全責任。

4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 28(4) GDPR:

8.5.6 Disclosure of subcontractors used to process PII

Control

The organization should disclose any use of subcontractors to process PII to the customer before use.

Implementation guidance

Provisions for the use of subcontractors to process PII should be included in the customer contract.


访问全文

5. 處理者遵守第 40 條所定經核准之行為守則或第 42 條所定經核准 之認證機制者,得作為本條第 1 項及第 4 項所定充分保證之證明。

5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article.

6. 於無損及控管者及處理者間個別性契約之情況下,本條第 3 項及 第 4項所定契約或其他立法得全部或一部基於第 7項及第 8項所定之 定型化契約條款,包括當其係依據第 42 條及第 43 條所定授予控管者 或處理者認證之一部分時。

6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43.

相关文章

7. 執委會得就本條第 3 項及第 4 項所定事項擬定定型化契約條款, 並遵守第 93 條第 2 項所定之檢驗程序。

7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2).

相关文章

8. 監管機關得就本條第3項及第4項所定事項採用定型化契約條款, 並遵守第 63 條所定之一致性機制。

8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.

相关文章

9. 第 3 項及第 4 項所定契約或其他立法應以書面為之,包括電子形 式。

9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.

10. 於無損及第 82 條、第 83 條及第 84 條規定之情況下,如處理者 決定處理之目的與方式違反本規則者,該處理者應被視為係該處理之 控管者。

10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.

相关文章
專家評論 ISO 27701 献技 指南和案例法 发表评论
專家評論

(EN) A processor is a person or an organization that processes personal data on behalf and under the authority of a controller [Articles 4(8) and 28(1)]. The term used in the English text of the General Data Protection Regulation (GDPR) remains difficult to apprehend by a non-legal audience, so it is useful to turn to other linguistic versions for a better understanding.


访问全文

(EN) Author
Louis-Philippe Gratton
(EN) Louis-Philippe Gratton PhD, LLM
(EN) Privacy Expert
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.1.

Here is the relevant paragraph to articles 28(5), 28(6), and 28(10) GDPR:

5.2.1 Understanding the organization and its context

The organization shall include among its interested parties (see ISO/IEC 27001:2013, 4.2), those parties having interests or responsibilities associated with the processing of PII, including the PII principals.


访问全文

献技

(81) 為確保處理者代控管者執行處理活動時遵循本規則,當委託處 理者處理活動時,控管者應只委託具有足夠保證(尤其是就專業知識、 可信度與資源而言)之處理者,以符合本規則之要求而執行科技化與 組織化之措施,包括處理之安全性。處理者採取經核准的行為守則或 認證機制可用以證明其有遵循控管者之義務。處理者就處理之執行應 受到契約或符合歐盟法或會員國法之其他法規控管,將處理者結合至 控管者、明列主體事項及處理持續之時間、處理之本質與目的、個人 資料之類型及資料主體之分類,並考慮所欲執行之處理脈絡下處理者 之特定任務與責任,以及資料主體之權利與自由的風險。控管者與處 理者得選擇使用個別性契約或定型化契約條款,該條款須或為執委會 所直接採用,或經監管機關以一致性機制再由執委會所採用者。代表 控管者完成處理後,基於控管者之選擇,處理者應返還或刪除個人資 料,除非處理者所受拘束之歐盟法或會員國法要求處理者儲存個人資 料。

(81) To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk to the rights and freedoms of the data subject. The controller and processor may choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by a supervisory authority in accordance with the consistency mechanism and then adopted by the Commission. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.

指南和案例法 发表评论