Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
There are two ways for the data controller to let someone else process the data he controls:
Now, when to authorise and when to sign a contract? Why are employees authorized instead of signing processing agreements with them?
It is the controller's job to ensure safety and lawfulness of the data processing, and to take appropriate measures. This can always include things such as contracts. For example, the GDPR explicitly suggests that two joint controllers can sign a contract that divides up their responsibilities.
A Data Processing Agreement is most attractive when viewed from the perspective of the prospective Processor: by default they would just be a Controller with all the obligations that includes. Under a DPA the Processor gives up a lot of flexibility: they can only process data as per the controller's instructions. They can't decide the purposes themselves. But in return the Processor has a simplified status. For instance, they don't have to interact with data subjects at all.
Because this makes compliance so much easier, a service provider will typically refuse service for a controller if no DPA is signed. The upside for the controller is that they get the service, and they also get legal assurances that the processor will implement certain safety measures. If the Processor is in a Third Country, the DPA will also discuss some legal basis for these international transfers.
Reading just the definition of a Processor, it seems like employees would be Processors: they process the personal data on the Controller's behalf. But this interpretation is nonsensical and runs against common interpretation (which some data protection authorities have made explicit). Employees are better understood as part of the Controller's organization. The Controller can directly manage their employees through organizational measures and through legal instruments such as confidentiality agreements.
