L 119/50
Official Journal of the European Union
EN
4.5.2016
With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its
opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.
4.
Where a processor engages another processor for carrying out specific processing activities on behalf of the
controller, the same data protection obligations as set out in the contract or other legal act between the controller and
the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal
act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical
and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where
that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the
controller for the performance of that other processor's obligations.
5.
Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification
mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as
referred to in paragraphs 1 and 4 of this Article.
6.
Without prejudice to an individual contract between the controller and the processor, the contract or the other
legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual
clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the
controller or processor pursuant to Articles 42 and 43.
7.
The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of
this Article and in accordance with the examination procedure referred to in Article 93(2).
8.
A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4
of this Article and in accordance with the consistency mechanism referred to in Article 63.
9.
The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic
form.
10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes
and means of processing, the processor shall be considered to be a controller in respect of that processing.
Article 29
Processing under the authority of the controller or processor
The processor and any person acting under the authority of the controller or of the processor, who has access to
personal data, shall not process those data except on instructions from the controller, unless required to do so by Union
or Member State law.
Article 30
Records of processing activities
1.
Each controller and, where applicable, the controller's representative, shall maintain a record of processing
activities under its responsibility. That record shall contain all of the following information:
(a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representa
tive and the data protection officer;
(b) the purposes of the processing;
(c) a description of the categories of data subjects and of the categories of personal data;