The data processing agreement: what happens after signing
A data processing agreement shapes the legal link between the controller and the processor. Under the first paragraph of Article 36 of the Georgian Law on Personal Data Protection, a processor may process data only on the basis of a legal act or a written agreement which defines the grounds and purposes of processing, the categories of data to be processed, the term of processing and the rights and obligations of the parties. The focus of this page, however, is not the text of the agreement but its lifecycle: what obligations the parties bear while the agreement operates, in disputes and upon its termination.
The law distributes clear roles here. The processor processes data only in accordance with the controller's written assignment or instruction; it ensures that the natural person directly involved in processing has a duty of confidentiality; it ensures the security of data in accordance with the law; and upon cancellation or termination of the agreement it deletes the data or transfers them to the controller and deletes the copies, unless their retention is required by legislation. Further processing of the data for a purpose different from that defined by the agreement or legal act is inadmissible.