The Data Protection (General) Regulations

25. Obligations of a data processor

Edition: 2022-12-31 · In force

(1)A data processor shall not engage the services of a third party without the prior authorisation of the data controller.

(2)Where authorisation is given, the data processor shall enter into a contract with the third party.

(3)The contract contemplated under subregulation (1) shall include such particulars as provided for under subregulation 24(2).

(4)A data processor shall remain liable to the data controller for the compliance of any third party that they engage.