The data processing agreement: what happens after signing
A data processing agreement shapes the legal link between the controller and the processor. Under the first paragraph of Article 36 of the Georgian Law on Personal Data Protection, a processor may process data only on the basis of a legal act or a written agreement which defines the grounds and purposes of processing, the categories of data to be processed, the term of processing and the rights and obligations of the parties. The focus of this page, however, is not the text of the agreement but its lifecycle: what obligations the parties bear while the agreement operates, in disputes and upon its termination.
The law distributes clear roles here. The processor processes data only in accordance with the controller's written assignment or instruction; it ensures that the natural person directly involved in processing has a duty of confidentiality; it ensures the security of data in accordance with the law; and upon cancellation or termination of the agreement it deletes the data or transfers them to the controller and deletes the copies, unless their retention is required by legislation. Further processing of the data for a purpose different from that defined by the agreement or legal act is inadmissible.
Preliminary verification and monitoring
Choosing a partner does not end at the moment of signing. Under the sixth paragraph of Article 36, the controller is obliged to demand from the processor, in advance, information on the processing of data in accordance with the law and to monitor the processing carried out by the processor. This means that the right and duty of control are continuous: they begin before the agreement and continue throughout its operation.
In addition, where the processor's activity or aims create a high risk of non-purpose processing of data or of violation of the rights of subjects, concluding an agreement with such a person is inadmissible at all. Managing the agreement therefore begins with a risk assessment: who the partner is, what it does and how far its activity corresponds to the purposes for which the data are transferred.
Sub-processors and the consent rule
The processing chain often does not stop at one processor. Under the seventh paragraph of Article 36, unless otherwise provided by Georgian legislation, it is inadmissible for the processor to transfer its rights and duties, in full or in part, to another person without the controller's prior written consent. An important addition: the controller's consent does not release the processor from the corresponding obligations and liability.
The practical effect is clear: consent is a formal permission for engaging a sub-processor and not a redistribution of responsibility. The controller remains answerable for the behaviour of the entire chain, which is why the list of sub-processors, verification of their compliance and the procedure for consenting to changes are indispensable parts of managing the agreement.