The legal basis — why a written agreement is mandatory
When an organization entrusts data processing to a third party — a service provider, a cloud, a contractor — Article 36 of the Law on Personal Data Protection strictly defines the form: a processor may process data only on the basis of a legal act or a written agreement concluded with the controller. The existence of a contract is not a matter of prudence — it is a statutory condition without which the processing is unlawful. That is why the data processing agreement is the legal rampart of every outsourcing relationship.
Under point 1 of Article 36, the agreement must define: the grounds and purposes of processing; the categories of data to be processed; the term of processing; and the rights and obligations of the controller and the processor. The agreement thus answers at minimum four questions — why, what, for how long, and who does what. If these elements are not defined, the agreement fails the law's requirement, though the parties remain free to add further terms.
Mandatory clauses — five duties the contract must carry
Point 2 of Article 36 regulates the processor's duties that must enter the agreement: first — data are processed only under the controller's documented instruction; second — the natural persons directly involved in processing bear a confidentiality duty; third — data security is ensured in accordance with the law; fourth — on termination or expiry of the agreement the data are deleted or handed over to the controller, copies included, unless storage is required by legislation; fifth — the controller receives appropriate information for compliance and is facilitated in monitoring the processing. These five points are the contract's minimum framework — without them the document is deficient.
The bounds of the mandate and sub-processors
The law actively protects the mandate's bounds: further processing for purposes different from those defined by the agreement or legal act is prohibited. Processing through a processor is permissible only where the processor takes appropriate organizational and technical measures to protect the subject's rights and the law's requirements; and where the processor's activity carries a high risk of non-purposeful processing or violation of rights, concluding the agreement is prohibited. The controller must request information in advance on law-compliant processing and monitor it. Transferring one's rights and duties to another person — a sub-processor — is possible only with the controller's prior written consent, and that consent does not release the processor from its obligations. On a dispute, processing stops immediately and the data are fully transferred to the controller; the same happens when the agreement ends.