0

I have just become aware of this particular Article 29, which has one good side: it is short.

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

Then in Article 28 about "Processor",

(a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

Not to mention Article 32.

If I were to be asked about any instructions, "I don't know" kind of answer would probably be the only one. I have mostly developed new features for a MVC framework and installed those new features to the production system. Things like checklists and guidelines have not been provided.

Right now my own conclusion is that I should not to copy or modify any database or install any code update that changes how personal data is processed.

I have been employed on a small company for some years, i.e. before and after gdpr come to effect. The company acts as a processor for multiple controllers.

I'll probably make some phone calls anyway tomorrow.

Improve this question
1
  • Could you clarify who has processor status in your scenario? An employee is not a processor on behalf of a company, they are part of the company as far as the GDPR is concerned. However, your employer may or may not be a processor.
    – amon
    May 27, 2019 at 20:04

1 Answer 1

Reset to default
1

1st - you should have a service scope defined by a services contract, right? Meaning how did you become incumbent of doing something in the first place? If there is no Contract, ask for one.

2nd - you should also have an addendum to that contract which is the Data Processing Agreement, and there is where your specific "scope" and "purpose" of acting upon that Data needs to be described, along with mutual and particular commitments towards Personal Data Protection under GDPR.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .