# Processing Agreement — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/processing-agreement
> Sources are cited per item. Verify against the official texts before relying on them.

Contract between controller and processor defining processing terms

## Overview

## Legal Framework

A processing agreement under GDPR binds a controller and processor to specific terms governing the processing of personal data. Where the processor is located outside the EEA, the agreement must incorporate appropriate safeguards for international transfers under [Article 46](/laws/gdpr/art-46) GDPR. [Article 46(2)(c)](/laws/gdpr/art-46#par-2-pnt-c) recognizes Commission-adopted standard contractual clauses as a valid safeguard:

> "standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2)"
> — [GDPR Art. 46(2)(c)](/laws/gdpr/art-46#par-2-pnt-c)

Recital 109 clarifies that SCCs may be embedded within broader contractual frameworks:

> "Controllers and processors should be encouraged to provide additional safeguards via contractual commitments that supplement standard protection clauses."
> — [GDPR Recital 109](/laws/gdpr/rec-109)

Supervisory authorities retain broad corrective powers under [Article 58](/laws/gdpr/art-58) GDPR to address failures in processing agreements, including ordering compliance within specified periods.

## Key Developments

Enforcement actions confirm that the absence of a valid processing agreement constitutes a standalone infringement. The Croatian DPA (AZOP) fined a hospital €190,000 partly for failing to enter into a data processing agreement. The Irish DPC, in the Midlands Regional Hospital investigation, rejected the notion that a service level agreement and confidentiality agreement sufficed:

Dutch courts have addressed whether a processing agreement was actually concluded. In a case involving ActiveCampaign, the claimant argued the AP should have enforced against both the absence of a valid processing agreement and missing SCCs. The Rechtbank held that formation of an agreement is a civil law question extending beyond mere signatures:

> "de totstandkoming van een overeenkomst een civielrechtelijke vraag is, die meer omvat dan alleen of er handtekeningen zijn gezet"
> — [Rechtbank, §3.15](/posts/50537#seg-3.15)

The court upheld the AP's decision to close the case where signed agreements and SCCs existed, noting the AP's prioritization policy could justify not pursuing further investigation.

## Status of the Debate

This topic is contested in court. Courts have diverged on whether the existence of a signed document suffices to demonstrate a valid processing agreement or whether full civil law formation requirements must be assessed. The Dutch ruling that agreement formation involves more than signatures—and that supervisory authorities may exercise discretion to deprioritize enforcement—leaves the practical threshold unclear. No court split is on record yet, but a ruling clarifying what evidentiary standard applies to processing agreement formation under Article 28 would resolve the open question.

## Practical Guidance

- Execute written processing agreements before any processing begins; service level agreements or confidentiality provisions alone do not satisfy Article 28 requirements.
- Where the processor transfers data outside the EEA, incorporate approved SCCs and ensure both parties have signed them before the transfer occurs.
- Do not rely on a processor's general GDPR compliance posture to cover your controller obligations; the DPC has explicitly rejected this argument.
- Document the full contractual formation process, not just signatures, given that courts treat agreement formation as a civil law question involving more than execution.
- Where agreements are missing or incomplete, document remediation promptly; supervisory authorities apply prioritization criteria and may exercise discretion not to pursue enforcement.

## Legislation (full text of key provisions)

### Recital 109 — standard data protection clauses contractual flexibility

*Source: GDPR, gdpr-rec-109-en, 2016-04-27 — https://overview.legal/posts/91733*

The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from including the standard data-protection clauses in a wider contract, such as a contract between the processor and another processor, nor from adding other clauses or additional safeguards provided that they do not contradict, directly or indirectly, the standard contractual clauses adopted by the Commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects. Controllers and processors should be encouraged to provide additional safeguards via contractual commitments that supplement standard protection clauses.

### Recital 108 — appropriate safeguards for international data transfers

*Source: GDPR, gdpr-rec-108-en, 2016-04-27 — https://overview.legal/posts/91731*

In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority. Those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default. Transfers may also be carried out by public authorities or bodies with public authorities or bodies in third countries or with international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding, providing for enforceable and effective rights for data subjects. Authorisation by the competent supervisory authority should be obtained when the safeguards are provided for in administrative arrangements that are not legally binding.

## Case law

### Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems

*Source: CJEU, 2020-07-16 — https://overview.legal/posts/6120 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=6120*

“[…] the standard data protection clauses adopted by the Commission on the basis of Article 46(2)(c) of the GDPR are solely intended to provide contractual guarantees that apply uniformly in all third countries to controllers and processors established in the European Union and, consequently, independently of the level of protection guaranteed in each third country. In so far as those standard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contrac

### Data Protection Commissioner v Facebook Ireland and Maximillian Schrems

*Source: CJEU, C-311/18, 2020-07-16 — https://overview.legal/posts/51470 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=51470*

Invalidated Privacy Shield adequacy decision and upheld validity of Standard Contractual Clauses with additional safeguards required.

### Thomas Bindl v European Commission

*Source: General Court, T-354/22, 2025-01-08 — https://overview.legal/posts/132155 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TJ0354*

In Case T-354/22, Thomas Bindl sought annulment of alleged personal data transfers to third countries by the European Commission when visiting the Conference on the Future of Europe website, a declaration of failure to act on his information request, and EUR 1,200 in damages for non-material harm under Regulation (EU) 2018/1725. The General Court found the annulment action inadmissible as the alleged transfers did not constitute a challengeable act, declared there was no need to adjudicate the failure-to-act claim since the Commission had subsequently responded, and dismissed the damages claim for lack of a sufficiently serious breach and causal link. No fine was imposed.

### Meta Platforms and Others v Bundeskartellamt

*Source: CJEU, C-601/21, 2023-07-04 — https://overview.legal/posts/51482 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0601*

Competition authorities can assess GDPR compliance in context of competition law proceedings.

### Google LLC v CNIL

*Source: CJEU, C-507/17, 2019-09-24 — https://overview.legal/posts/51476 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0507&ref=51476*

Right to delisting does not require global de-referencing under EU law.

### Deutsche Wohnen SE v Staatsanwaltschaft Berlin

*Source: CJEU, C-807/21, 2023-12-05 — https://overview.legal/posts/51487 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0807*

Fines can be imposed directly on legal persons without identifying responsible natural person.

### CJEU - C-311/18 - Facebook Ireland and Schrems

*Source: Court of Justice of the European Union, 2026-07-17 — https://overview.legal/posts/125639 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-311/18_-_Facebook_Ireland_and_Schrems*

Facts — Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. As is the case with users residing in the European Union, some of the data belonging to Mr. Schrems had been transferred by Facebook Ireland to its servers belonging to Facebook Inc., located in the United States. In 2013, Mr. Schrems complained to the Irish Data Protection Commissioner (DPC) seeking to prohibit these transfers. When this complaint was rejected, he brought an action against the decision before the Irish High Court, which in turn referred a number of questions to the CJEU, the most prominent of which was whether the EU-US adequacy decision, the so-called “Safe Harbor", was valid. In its judgment on October 6th 2015 (Case C-362/14, “Schrems I”), the CJEU invalidated the Safe Harbor and stated that, in order to be "adequate", the level of data protection offered by the third country should be “essentially equivalent” to that being offered in the EU. As a result, the High Court annulled the decision rejecting Mr. Schrems’ complaint, and referred the case back to the DPC. In the remittal “judgment” before the DPC, Facebook Ireland explained that the invalidated adequacy decision was not relevant as a large part of personal data was transferred to Facebook Inc. pursuant to Standard Contractual Clauses (SCCs). On this basis, the DPC asked Mr. Schrems to reformulate his complaint. In his reformulated complaint lodged on December 1st 2015, Mr. Schrems alleged that US law required Facebook Inc. to disclose his personal data to certain United States authorities in the context of various monitoring programs (in particular, the FISA 702 and the Executive Order 12.333). In Mr Schrems’ view, these programs contravened different data protection principles as well as Article 7 CFR, Article 8 CFR, and Article 47 CFR. After investigating the allegations made by Mr. Schrems, the DPC argued that it could not adjudicate on them until the CJEU had examined the validity of the SCCs, and so it brought proceedings before the High Court. On May 4th 2018 the High Court made the reference for a (second) preliminary ruling to the CJEU. In its reference to the CJEU, the High Court specified that Section 702 of the FISA permitted the Attorney General and the Director of National Intelligence to authorize jointly, following FISA approval, the surveillance of individuals who are not US citizens and who are located outside of the US in order to obtain foreign intelligence information. It was also affirmed that Section 702 of the FISA provided the basis for the PRISM and UPSTREAM surveillance programs. PRISM in particular, requires Internet Service Providers (ISPs) to supply the NSA with all communications to and from a ‘selector’. UPSTREAM on the other hand, permitted the NSA to copy and filter Internet traffic flows from the ‘backbone’ of the internet, granting it access to both the content of communications and their metadata. Furthermore, the High Court had found that Executive Order 12.333 (E.O. 12333) allowed the NSA to access data in transit by accessing underwater cables on the floor of the Atlantic. The High Court stated that the only limit on US surveillance activities was found in the Presidential Policy Directive (PPD-28), and even this only stated that intelligence activities should be ‘tailored as feasible’. On the basis of these findings, the High Court considered that the US carried out mass processing of personal data without ensuring a level of protection that was essentially equivalent to that which was guaranteed by Article 7 CFR and Article 8 CFR. The High Court also highlighted that EU citizens did not have the same remedies available to them as US citizens with regards to the processing of their personal data, since the Fourth Amendment to the Constitution of the United States did not apply to non-US citizens. This meant that it was particularly difficult for EU citizens to establish standing before a US court. Moreover, activities based on E.O. 12333 were not subject to judicial oversight and were not justiciable. Given the considerable effects of US surveillance law on the rights of Europeans, the High Court raised the question of whether the SCCs are valid, given that they may not be binding on the State authority of the third country. If they did not bind the third country State authority, then they are not capable of remedying a possible lack of an adequate level of protection of personal data. Dispute — The request for a preliminary ruling referred eleven questions to the Court of Justice. The topics covered in these questions were as follows: the applicability of EU law to data transfers made for commercial purposes, but further processed for national security and law enforcement purposes the relevant legislation for determining whether there has been a violation of individual rights how to assess the level of protection in a third country whether data transfers to the US violate the Charter whether the level of protection offered in the US respects or limits an individual’s right to a judicial remedy what level of protection is required to be afforded to personal data that is transferred under SCCs whether the SCCs can even be adequate as safeguards given they do not bind national authorities whether there is an obligation to suspend data flows if a data importer is subject to surveillance law what the relevance of the Privacy Shield decision is with regards to assessing safeguards whether the presence of an ombudsperson can ensure that the US provides an effective remedy to data subjects whether the SCCs violate the Charter Holding — The Court began by clarifying that the GDPR applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State, to another economic operator established in a third country, even if in that country the data would be processed by the national authorities for public security, defense, and state security purposes. In particular, the Court stressed that a transfer of data is not excluded from the scope of the GDPR for the reason that it may be processed by the national authorities of a third country. Regarding the level of protection required in such an instance, the Court held that the requirements presented by the GDPR regarding safeguards, enforceable rights, and legal remedies must continue to be applied. In other words, when their data is transferred abroad, a data subject must be afforded a level of protection essentially equivalent to that which they would receive in EU. In such circumstances, in order to assess the level of protection, both existing contractual clauses between the data importer and exporter, and the potential access by public authorities in a third country must be taken into account, along with the relevant aspects of the legal system in the third country. The Court then analyzed Decision 2016/1250 (the “Privacy Shield”), which was the self-certification scheme in place for controllers based in the US. Examining the decision in light of the provisions of the Charter, the Court held that the requirements of US national security, public interest, and law enforcement do in fact interfere with the fundamental rights of persons whose data is transferred there. These limitations on the protection of personal data were not circumscribed in a way that satisfied requirements that are essentially equivalent to those required under EU law. The principle of proportionality was also not satisfied, in so far as US surveillance programs are not limited to what is ‘strictly necessary’. It was noted that the provisions in the US surveillance programs neither limited the power they conferred onto national authorities, nor granted data subjects actionable rights before the courts against the US authorities. The Court proceeded to scrutinize the Ombudsperson mechanism that had been in place under the Privacy Shield, stating that it too did not provide data subjects with a cause of action before a body which was fully independent, and that this body was limited in so far as it could not impose rules that were binding on US intelligence services. Taking all of this into account, the Court declared the Privacy Shield Decision to therefore be invalid. The Court also clarified that in the absence of an adequacy decision, the competent supervisory authorities are required to suspend or prohibit a transfer of personal data to a third country where they consider that the standard data protection clauses are not or cannot be complied with in the third country, and that the protection of the data transferred cannot be ensured by other means. Following this, the Court then examined the validity of the SCCs (Decision 2010/87). First, the Court held that the validity of the Decision was not called into question by the mere fact that the SCCs do not bind national authorities in a third country. After establishing this, the Court emphasized that the validity of the SCCs, however, did depend on whether there were effective mechanisms in place that make it possible to ensure compliance with the level of protection required by EU law. Important to note is that here the Court held that the SCCs in themselves did provide for such mechanisms. However, it went on to stress that where these mechanisms cannot be complied with, the transfers of personal data pursuant to these clauses is to be suspended or prohibited. Furthermore, there is an obligation on the data exporter and the recipient of the data to verify prior to a transfer, what the level of protection in a third country is, and whether it will be possible to comply with the requirements of the SCCs.

### Maximillian Schrems v Data Protection Commissioner

*Source: CJEU, C-362/14, 2015-10-06 — https://overview.legal/posts/51471 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362&ref=51471*

Invalidated Safe Harbor adequacy decision. National supervisory authorities can examine adequacy decisions.

### Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems

*Source: CJEU, 2020-07-16 — https://overview.legal/posts/5945 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311*

“the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of natural persons with regard to the processing of personal data. Each of those authorities is therefore vested with the power to check whether a transfer of personal data from its own Member State to a third country complies with the requirements laid down in that regulation” / “The exercise of that responsibility is of particular importance where personal data is tra

### SG Nürnberg: MOVEit zero-day cyberattack via processor did not breach Art. 32 GDPR

*Source: Social Court Nuremberg, 2026-06-10 — https://overview.legal/posts/122874 — original: https://gdprhub.eu/index.php?title=SG_Nürnberg_-_S_5_SF_65/24_DS*

Facts — The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus programme. The bonus programme was managed via an app. To handle the information technology operations of this programme, the controller hired the processor (an IT service provider), establishing a data processing agreement under Article 28 GDPR alongside specific information security guidelines. To provide these services, the processor utilised "MOVEit Transfer," a market-leading file transfer software developed by Progress Software Corp. On 31 May 2023, the software developer publicly announced a critical, previously unknown "zero-day" vulnerability in the software (later assigned CVE-2023-34362). At that exact moment, no security patch was available. On the very same day, 31 May 2023, the processor – alongside thousands of other companies worldwide – became the victim of a global cyberattack carried out by the hacker group "Clop." The hackers exploited this zero-day vulnerability to install a "web-shell" backdoor (typically named human2.aspx), bypassing authentication to exfiltrate database records. The compromised data included the data subject's first and last name, health insurance number, bonus points balance, and a bank account number (IBAN) belonging to her mother. No medical, health, or social security data was exfiltrated. On 1 June 2023, the developer released a security patch, which the processor installed immediately. On 2 June 2023, the German Federal Office for Information Security (BSI) issued a formal IT security warning (No. 2023-240133-1100, Version 1.1). The BSI classified the IT threat level as "3 / Orange" (business-critical), confirming active exploitation with data exfiltration. The BSI recommended immediately blocking all HTTP and HTTPS traffic to MOVEit environments, checking for specific Indicators of Compromise (IoCs) in the web server directories, and applying the newly released patch before reconnecting systems to the network. On 16 June 2023, the processor informed the controller about the incident. On 17 June 2023, the controller issued a public press release confirming that its external service provider for the bonus programme had been targeted on 31 May 2023. The release stated that the security vulnerability had been closed, that there was never any connection to the controller's internal IT systems, and that relevant supervisory authorities had been notified. The controller subsequently notified the data subject's parents. On 27 March 2024, the data subject, via legal counsel, sent a formal warning letter to the controller demanding an injunction, a declaration of liability for all potential future damages, and non-material damages of at least €3,000. Following the controller's refusal, the data subject filed a lawsuit with the Nuremberg Social Court (Sozialgericht Nürnberg), later expanding the claim to the processor as a joint defendant. Holding — The Court dismissed the lawsuit as partly inadmissible and otherwise unfounded, establishing the following legal principles: First, the Court held that a successful third-party cyberattack does not establish an irrebuttable presumption that a controller or processor failed to implement appropriate security measures under Article 32(1) GDPR and Article 5(1)(f) GDPR. To escape liability under Article 82(3) GDPR, an operator must prove they implemented robust baseline security controls (such as multi-factor authentication, encryption, and lockout policies) and applied a security patch immediately upon its release by the vendor, even if this occurred before formal alerts were issued by national IT security authorities. Second, the Court held that a claim for non-material damages under Article 82(1) GDPR based on the fear or distress of future data misuse cannot be established if the data subject is a minor who has no subjective knowledge or cognitive awareness of the data breach. Furthermore, if the compromised financial data (such as an IBAN) does not belong to the data subject personally, there is no direct risk of financial harm to them, rendering the alleged fear of financial damage unfounded. Third, the Court held that an injunction claim is inadmissible due to a lack of specificity if it merely demands that a controller stop making personal data accessible to third parties without implementing "state-of-the-art" security measures, without specifying the concrete technical or organisational measures the controller is required to take. Fourth, the Court held that a declaratory claim for potential future material damages is inadmissible under national procedural law (§ 55(1) SGG) if there is no realistic probability of future financial harm, particularly because the compromised bank account belonged to a third party (the mother) and the software vulnerability was immediately patched.

### Munich Court: §11(8) RBStV validly restricts Art. 15 GDPR access for broadcasting

*Source: Administrative Court Munich, 2026-05-18 — https://overview.legal/posts/108991 — original: https://gdprhub.eu/index.php?title=VG_München_-_M_26a_K_25.5210*

Facts — The data subject had been liable to pay broadcasting contributions to the Controller, a German regional public broadcasting authority, since 2007. Following objections to several contribution assessment notices, the data subject submitted a request under Article 15 GDPR seeking a copy of all personal data processed about him by the Controller. The Controller responded by providing the categories of personal data and related information specified under § 11(8) of the German Broadcasting Contribution Treaty (RBStV), which governs data subject access requests relating to broadcasting contribution records, together with general privacy information. The data subject argued that the response was incomplete because it did not include copies of all documents containing his personal data, including correspondence with him and third parties. The Controller maintained that it had fully complied with its obligations under the RBStV. After the Controller declined to provide additional information, the data subject brought proceedings seeking disclosure of all personal data concerning him processed by the Controller. Holding — The Court held that § 11(8) of the German Broadcasting Contribution Treaty (RBStV) constituted a lawful restriction of the broader right of access under Article 15 GDPR pursuant to Article 23(1)(e) GDPR. It found that the national provision was a valid legislative measure, respected the essence of the fundamental right to data protection, and pursued an important public interest by ensuring the effective financing and administration of the public broadcasting system. The Court further held that the restriction was necessary and proportionate, noting that requiring the Controller to comply with the full scope of Article 15 GDPR across more than 44 million broadcasting contribution accounts would impose a disproportionate administrative and financial burden capable of undermining that public interest. The Court also held that § 11(8) RBStV satisfied the safeguards required under Article 23(2) GDPR by specifying the purposes of processing, categories of personal data, scope of the restriction, safeguards against misuse and unlawful access, the identity of the Controller, applicable storage periods and other statutory protections. Accordingly, while the Controller was required to disclose the categories of information specified under § 11(8) RBStV, it was not required to provide a copy of all personal data processed under Article 15(3) GDPR. As the Controller had already provided all information required under the national provision, the court dismissed the action.

### LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR

*Source: LG Rostock, 2020-09-15 — https://overview.legal/posts/122848 — original: https://gdprhub.eu/index.php?title=LG_Rostock_-_3_O_762/19*

Facts — The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries. The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies. The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019 ("Planet 49"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors. (Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.) Dispute — Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)? Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR? Did the defendant violate GDPR provisions on transparency? Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers? Holding — Legal basis and validity of consent — The court held that the marketing and analytics cookies used by the defendant c an only be placed with the users' consent under Article 6(1)(a) GDPR : § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons. Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big "OK" button. The option "use only necessary cookies" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered "freely given" and was invalid. Transparency — The court further held that the defendant violated Article 13 GDPR by mentioning an incorrect transfer mechanism under Articles 44 et seqq. GDPR for data transfers in connection with the use of cookies. Sole or joint controllership when using Google Analytics? — Lastly, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google . Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the official opinion of the "Datenschutzkonferenz", a gathering of all German DPAs.

## Guidance

### Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)

*Source: EDPB, opinion-222024-on-certain-obligations-following-from-the-en, 2024-10-09 — https://overview.legal/posts/125715 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-222024-on-certain-obligations-following-from-the_en*

A dopted 1 Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s) Adopted on 7 October 2024 Adopted 2 Executive summary The Danish SA requested the EDPB to issue an opinion on matters of general application pursuant to Article 64(2) GDPR. The opinion contributes to a harmonised interpretation by the national supervisory authorities of certain aspects of Article 28 GDPR, whe re appropriate in conjunction with Chapter V GDPR. In particular, the…

### EDPB Document setting forth a Cooperation Procedure for the Authorisation of Contractual Clauses under Article 46(3)(a) GDPR and for the Adoption of Standard Contractual Clauses under Article 46(2)(d) GDPR

*Source: EDPB, edpb-document-setting-forth-cooperation-procedure-en, 2026-01-22 — https://overview.legal/posts/53749 — original: https://www.edpb.europa.eu/documents/procedure/edpb-document-setting-forth-a-cooperation-procedure-for-the-authorisation-of_en*

EDPB, EDPB Document setting forth a Cooperation Procedure for the Authorisation of Contractual Clauses under Article 46(3)(a) GDPR and for the Adoption of Standard Contractual Clauses under Article 46(2)(d) GDPR

### EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries

*Source: EDPB, edpb-edps-joint-opinion-22021-on-standard-contractual-clauses-for-the-en, 2021-01-14 — https://overview.legal/posts/126083 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-22021-on-standard-contractual-clauses-for-the_en*

Adopted 1 EDPB - EDPS Joint Opinion 2 /2021 on the European Commission’s Implementing Decision on standard contractual clauses for the transfer of personal data to third countries for the matters referred to in Article 46(2)(c) of Regulation (EU) 2016/679 Adopted 2 Adopted 4 The European Data Protection Board and the European Data Protection Supervisor Having regard to Article 42(2) of the Regulation 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing…

### Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems

*Source: EDPB, frequently-asked-questions-on-the-judgment-of-the-court-of-justice-of-the-en, 2020-07-24 — https://overview.legal/posts/126131 — original: https://www.edpb.europa.eu/documents/other-guidance/frequently-asked-questions-on-the-judgment-of-the-court-of-justice-of-the_en*

1 F requently Asked Questions on the judgment of the Court of Justice of the European Union in Case C - 311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems Adopted on 23 July 2020 This document aims at presenting answers to some frequently asked questions received by supervisory authorities (“SAs”) and will be developed and complemented along with further analysis, as the EDPB continues to examine and assess the judgment of the C our t of J ustice of the E…

### Information note on data transfers under the GDPR to the United Kingdom after the transition period

*Source: EDPB, information-note-on-data-transfers-under-the-gdpr-to-the-united-kingdom-en, 2020-12-15 — https://overview.legal/posts/126093 — original: https://www.edpb.europa.eu/documents/other-guidance/information-note-on-data-transfers-under-the-gdpr-to-the-united-kingdom_en*

Adopted 1 Information n ote on data transfers under the GDPR to the United Kingdom after the transition period Adopted on 15 December 2020 T he transition period for the United Kingdom’s withdrawal from the European Union will end on 31 December 2020 . This means that as of 1 January 2021, the UK will no longer apply the GDPR to the processing of personal data and a separate legal framework reg arding data protection will be in force in the UK . Consequently, as of 1 January 2021 , all…

### Opinion 23/2025 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Tessi Group

*Source: EDPB, opinion-232025-on-the-draft-decision-of-the-french-en, 2025-10-07 — https://overview.legal/posts/125692 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-232025-on-the-draft-decision-of-the-french_en*

Opinion 23/2025 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Tessi Group Adopted on 07 October 2025 1 | 2 | The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and…

### Opinion 25/2025 on the decision of the Polish Supervisory Authority regarding the Processor Binding Corporate Rules of the BOX Group

*Source: EDPB, opinion-252025-on-the-decision-of-the-polish-supervisory-en, 2025-10-07 — https://overview.legal/posts/125693 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-252025-on-the-decision-of-the-polish-supervisory_en*

Opinion 25/2025 on the decision of the Polish Supervisory Authority regarding the Processor Binding Corporate Rules of the BOX Group Adopted on 07 October 2025 1 | 2 | The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing…

### Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group

*Source: EDPB, opinion-32024-on-the-draft-decision-of-the-irish-supervisory-en, 2024-02-13 — https://overview.legal/posts/125771 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-32024-on-the-draft-decision-of-the-irish-supervisory_en*

Adopted Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group Adopted on 13 February 2024 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of…

## Enforcement decisions

### AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight

*Source: AEPD (Spain), 2026-09-23 — https://overview.legal/posts/354173 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00240-2025*

Facts — Vodafone España, S.A.U., the controller, operated a service known as "Super WiFi" through a third-party processor. Following a data breach affecting the service, the DPA's investigation found that personal data processed on behalf of the controller had been accessed without authorisation. The processor provided software services related to the Super WiFi service and processed and stored personal data of the controller's customers. The processor informed the controller of the security incident on 20 November 2023, and the controller notified the DPA of the personal data breach on 23 November 2023. The controller submitted a processing agreement which stated that it had entered into force in December 2022. However, the agreement was only formally signed in September 2024, after the data breach had occurred. The controller argued that the agreement had already been binding before its signature and that the absence of a signature did not mean that no contract existed. The controller also relied on two documents dated 22 December 2022 and 30 March 2023 to demonstrate that it had carried out audit and control activities concerning the processor. Neither document was signed and the DPA considered that they did not sufficiently demonstrate how the processor's security measures had actually been verified. The controller also claimed that encryption measures had been imposed on the processor. However, the only reference to this measure in the file appeared in the controller's initial written reply to the DPA inspector, unsupported by documentation, and the information available to the DPA indicated that the affected data were accessible in unencrypted form. The documents relied on by the controller referred to pseudonymisation but did not establish that encryption had been implemented. The controller raised several objections during the procedure. It argued in particular that a valid processing agreement already existed when the processing took place, that it had implemented adequate security and oversight measures, and that the previous sanctions should not be taken into account as an aggravating factor. Holding — The DPA rejected the controller's arguments. First, regarding Article 28 GDPR, the DPA held that a processor must be bound by a written contract or other legal act from the moment it begins processing personal data on behalf of the controller. Although the agreement submitted by the controller referred to an effective date in December 2022, it was not formally signed until September 2024. The DPA considered that giving the agreement retroactive effect could not remedy the period during which processing had already taken place without a formally perfected agreement. Therefore, the controller infringed Article 28 GDPR. The DPA stressed that allowing agreements concluded after processing had begun to operate retroactively would undermine the purpose of Article 28 GDPR. The processor must be formally subject to the controller's instructions and to the safeguards required by the GDPR throughout the processing relationship, rather than having those safeguards formalised ex post. Second, the DPA found an infringement of Article 32 GDPR. It considered that the technical and organisational measures implemented in relation to the processor were insufficient. In particular, the controller had not adequately demonstrated that relevant security measures were actually implemented and had relied substantially on information supplied by the processor without sufficiently verifying its effectiveness. The audit documents submitted by the controller did not explain the methodology used or demonstrate effective verification of the measures in practice. The DPA also rejected the controller's reliance on encryption. The available documentation did not demonstrate that the affected personal data were encrypted, and documents concerning cryptography referred to pseudonymisation rather than encryption. Third, the DPA held that the insufficient security measures resulted in a loss of confidentiality of personal data and therefore also constituted an infringement of Article 5(1)(f) GDPR. The DPA also considered two previous decisions against the controller, PS/00538/2021 and PS/00164/2022, as aggravating factors under Article 83(2)(e) GDPR. Both concerned infringements of Articles 5(1)(f) and 32 GDPR, and the controller had acknowledged its responsibility in both proceedings. When determining the fines, the DPA took into account, among other factors, the nature and gravity of the infringements and the controller's degree of responsibility. It also considered the controller's habitual processing of large volumes of personal data as an aggravating factor under Article 76(2)(b) LOPDGDD. The DPA imposed three administrative fines: €500,000 for the infringement of Article 5(1)(f) GDPR, €150,000 for the infringement of Article 32 GDPR and €100,000 for the infringement of Article 28 GDPR. The total fine therefore amounted to €750,000. No additional corrective measure was imposed.

### EDPS - 2021-0518

*Source: EDPS, 2024-03-08 — https://overview.legal/posts/125645 — original: https://gdprhub.eu/index.php?title=EDPS_-_2021-0518*

Facts — Following an investigation in 2019-2020, the EDPS issued recommendations and the Commission modified the ILA. The EDPS investigated whether these modifications were sufficient to bring processing in compliance with data protection requirements and found infringements. Data accessed by Microsoft include identity and contact data of users (when signing on to the service and when checking the licenses), data generated by the users while using the software and data generated by Microsoft based on the usage of the software. The EDPS found that the processing presents significant risks as it monitors the behaviour of users, combines datasets and uses artificial intelligence. Reference date is the 12th May 2021, the date when the investigation was launched. Some measures were taken meanwhile by the Commission, which were taken into account in the recommendations issued. Holding — The EDPS found infringements with regards to purpose limitation, transfers to a third country and further, unathorised disclosure of personal data. Purpose limitation: The EDPS found that it was not sufficiently defined in the International License Agreement (ILA) which types of personal data are to be processed for which purposes. Instead, there was only a list of purposes stating that Microsoft uses these data for: troubleshooting billing remunerating Microsoft staff, internal reporting and business modelling, financial reporting following the use of the system for own reasons (analytics) to improve the service security risk management protection of intellectual property These stated purposes were considered to be too vague and general pursuant to the Art 29 WP. The Commission and Microsoft could not demonstrate that all these data were necessary and that a less intrusive collection of data would be insufficient to achieve the purposes cited. In addition, some of these purposes were actually not in the interest of the Commission but for purposes of individual to Microsoft (like remuneration of their personnel). In this case, the processor acts as controller; thus, these purposes and the data used for this purposes should have been precisely defined. Also, if data were used for purposes other than for which they were collected, the compatibility of these new purposes with the original ones should have been assessed. As a processor, Microsoft should have processed the personal data on documented instructions by the Commission. This was not ensured as the Commission did not issue sufficiently clear documented instructions to Microsoft. For example, though the Commission gave instructions for analytics and improvement of the service, these instructions were not sufficiently detailed and precise and did not exclusively concern uses of data for the purposes of the controller. Some instructions were given orally, but this was not enabled by the ILA and the oral instructions were not documented. The Commission did not assess whether it is necessary and proportionate to transmit data to Microsoft Ireland and its sub-processors. Further details of this infringement are given under the part on further unauthorised disclosure or personal data. Transfer to third countries : The Commission transferred personal data to Microsoft, a company established in the US. This raises questions about adequacy for such transfers to a third country. After the reference date, the Commission adopted the Transatlantic Data Privacy Framework (TDPF), which is an adequacy decision in respect of recipients in the US who register under this framework. The EDPS found that even when the software and data storage is property of Microsoft, it is directly transferred to these subcontractors and cannot therefore be covered by the TDPF to Microsoft US and onward transfer from Microsoft US to other subcontractors under SCCs. The EDPS found that in was not clearly specified in the ILA what types of personal data can be transferred to which recipients in which third country. The Commission also did not appraise the transfers and therefore could not determine whether any supplementary measures are necessary. In addition, the Commission should have performed a data transfer impact assessment and (as there are no SCCs applicable by EUIs as exporters) should have submitted the DPAs with these processors or subprocessors in third countries to the EDPS for approval. Because it failed to do this, the Commission did not implement effective supplementary measures for these transfers. Another issue was that the “EU storage guarantee” offered by Microsoft did not cover all types of data. Some data may be accessible to recipients in third countries. The “EU Data Boundary” also has numerous exceptions and exclusions which cover customer data, service generated data, diagnostic data and professional services data. Further unauthorised disclosure or personal data: A specific reference was made to Article 9 Regulation (EU) 2018/1725, which concerns transmission of personal data by EU institutions to recipients established in the EU. According to the EDPS, this article is also applicable to transmission of personal data to processors of EUIs. Therefore all transmission of personal data should be in the public interest and if the data subject’s legitimate interests may be prejudiced, the controller has to weigh the competing interests and establish that it is proportionate to transmit the personal data. The purpose of management and functioning of the Commission, use of products the staff is familiar with etc. was not found to be the purpose of processing of the personal data by MS. As long as the purposes are not specified, specific and explicit, it is not possible to do this balancing. In addition, the EDPS found that the Commission did not ensure that transfers take place “solely to allow tasks within the competence of the controller to be carried out”. The EDPS determined that organisational and contractual measures to restrict/prevent access of third country authorities were not sufficient, and that further technical measures are thus necessary. The EDPS also found that the organisational measures applied are only limiting transfers but does not ensure that transfers are protected. Further, the encryption is only found to be an adequate measure if the controller is in control of the encryption key. In this case, customers control the keys, but Microsoft has access to the encryption key, and thus, even when law does not oblige it to decrypt the data on an authority request, it may do it voluntarily. Also, the ILA does not detail encryption of data other than “customer data”, i.e. diagnostic data, service generated data or professional services data. The contract also enabled the processor not to notify the Commission about a request of disclosure also when EU or Member State law did not prohibit this notification and enabled recipients in third countries not to notify requests for disclosure also when the law prohibiting it did not constitute a necessary and proportionate measure in a democratic society respecting the essence of the fundamental rights and freedoms recognised by the Charter.

### Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 4)

*Source: Datatilsynet (Denmark), 2022-09-28 — https://overview.legal/posts/6313 — original: https://gdprhub.eu/index.php?title=Datatilsynet_(Denmark)_-_2020-431-0061_(Helsingor_decision_no._4)*

Facts — This is the Danish DPA's fourth decision in the case relating to Helsingor municipality's processing of personal data in primary and lower secondary school. Helsingor municipality, the controller, has been using Google Chromebooks and Workspace for Education in violation of several GDPR requirements, as detailed in the first decision of September 2021, the second decision of 14 July 2022 and the third decision of 18 August 2022. Following the third decision, the municipality submitted more documentation and also requested a consultation with the DPA as per Article 36 GDPR. Holding — The DPA temporarily suspended its processing ban against Helsingor municipality until 5 November 2022, and also ordered the municipality to: Change the data processing agreement with Google so that the DPA's remarks in their 14 July and 18 August decisions, are implemented. This includes, at a minimum, a clarification of where and if Google acts as a sole controller and any uncertainties that may entail that Google acts beyond their role as a processor, see Article 28(3)(a) GDPR. Document that all transfers of personal data to insecure third countries, are in line with the GDPR. Describe all data flows and identify the personal data that are shared with the vendor, and clarify when the vendor acts as a sole or joint controller. This documentation must include the whole technology stack used by the municipality (for this processing activity). Update their data protection impact assessment based on all identified risks. Consult the DPA if the DPIA shows any high risks the municipality is not able to mitigate. If any processing activities are still not in line with the GDPR before the DPA's deadline 3 November 2022, present a final plan for bringing them in line with the GDPR.

### AEPD: Ramona Films failed to comply with Article 58(2) order to provide processor

*Source: AEPD (Spain), 2026-03-09 — https://overview.legal/posts/291400 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00008-2025*

Facts — RAMONA FILMS, S.L., the controller, operated websites offering audiovisual content through subscriptions. In November 2023, the DPA fined the controller in proceedings PS-00308-2023 for several GDPR infringements, including a breach of Article 28(3) GDPR concerning the absence of a data processing agreement with a payment service provider, the processor. The DPA also ordered the controller, pursuant to Article 58(2)(d) GDPR, to provide within one month the processor agreement concluded with the processor. In December 2023, instead of providing the requested agreement, the controller informed the DPA that the two companies should be considered joint controllers. Following an investigation, the controller provided an unsigned and undated purported joint controller agreement. It subsequently acknowledged that this agreement had never been signed. The controller also stated that it had terminated its relationship with the processor and discontinued its subscription service. However, it was unable to provide evidence of the termination and the DPA found that subscriptions continued to be available through the website and redirected users to the processor's payment service. The controller argued that it had complied with the measures imposed and requested the closure of the proceedings. Holding — The DPA found that the controller had infringed Article 58(2) GDPR by failing to comply with the corrective order issued in the previous proceedings. The DPA held that the controller had neither concluded the processor agreement required by the previous decision nor demonstrated that its relationship with the processor had instead been validly established as joint controllership under Article 26 GDPR. In particular, the purported joint controller agreement was unsigned and undated, and the controller ultimately acknowledged that it had never been concluded. The DPA also rejected the controller's arguments that the relationship with the processor and the subscription service had been terminated. It considered that the controller had provided contradictory information throughout the investigation and had failed to substantiate these claims. Consequently, the DPA found that the corrective measure imposed under Article 58(2)(d) GDPR remained unfulfilled. When determining the fine, the DPA considered, inter alia, the duration and intentional nature of the infringement, the fact that the processing involved identification and payment data, the close connection between the controller's activity and personal data processing, and the fact that the previous €40,000 fine for the Article 28(3) GDPR infringement had not achieved sufficient deterrent effect. The DPA therefore imposed a €60,000 fine for the infringement of Article 58(2) GDPR, pursuant to Article 83(6) GDPR.

### Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art.

*Source: DSB (Austria), 2026-08-25 — https://overview.legal/posts/291286 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_D130.2269*

Facts — The DPA was acting upon a complaint addressing the subject matter of third country personal data transfers. The controller, established in Ireland, operates an e-marketplace platform within the Union that connects costumers with independent vendors mostly located in Asia. The use of the controller’s platform requires potential costumers to create an account with the platform. When a customer orders a product via the platform, the controller establishes the contact between the costumer and the vendor. The parties of the purchase contract, however, are the customer and the vendor, not the controller. The processing of personal data in the context of providing the controller’s platform takes place within the Union and in the United Kingdom. In case of an order, the personal data is transferred to the vendors registered on the platform who offer the requested product. A customer (data subject) created an account with the controller’s platform in 2024. He logged into his account on the platform another time in 2024 and once in 2026, shortly after the procedure before the DPA was concluded. During his log-in in 2026, the data subject placed an order via the controller’s platform. In the course of the order, the data subject’s personal data was transferred to the People’s Republic of China and to two companies within the US. The European Commission has issued an adequacy decision pursuant to Article 45 GDPR concerning data transfers to the US (so-called “Data Privacy Framework”). Both US companies are featured on the “Data Privacy Framework List”. There is no adequacy decision concerning data transfers to the People’s Republic of China. The Irish DPA has declared itself not competent for the procedure at hand. Holding — The DPA held that the complaint at hand cannot be considered an abusive exercise of rights and was legally admissible. The question arose because the DPA considered the complaint as part of a campaign against processing of transfers of personal data to the People’s Republic of China. This is because the data subject was represented by a data protection organisation that has already filed several complaints on that subject matter in the past. Additionally, the data subject has initiated the transfer of personal data to the People’s Republic of China right before the procedure before the DPA by ordering from the controller’s platform. Yet, the DPA held that the data subject based his complaint overwhelmingly on motives relating to the exercise of his individual rights. Despite doubts concerning the incompetence of the Irish DPA, the Austrian DPA declared itself competent for handling the complaint in order to ensure the data subject’s right to an effective remedy as provided for under Article 13 of the European Convention on Human Rights, Article 47 of the Charter of Fundamental Rights of the European Union in conjunction with Article 77 GDPR. As far as the transfer of personal data to a third country is concerned, the DPA held that the transfer of personal data to the two US companies was lawful under the adequacy decision. The two companies were listed in the “Data Privacy Framework List”. As far as the transfer of data to the People’s Republic of China was concerned, for lack of an adequacy decision, the controller based the transfers of personal data on standard data protection clauses pursuant to Article 46(2)(c) GDPR. When relying on standard data protection clauses, the controller must ensure an adequate level of protection of personal data for the processing of personal data in the third country. In this context, the controller cannot solely rely on the contractual relationship and the standard data protection clauses between the data importer and data exporter. The controller has to consider the access of public authorities to personal data as well. The DPA held that the controller was unable to demonstrate an adequate protection of personal data for the transfer to the People’s Republic of China. The controller only referred to the standard data protection clauses and an overview of technical and organisational measures (TOMs). The TOMs did not deal with the issue of access of public authorities. Moreover, the controller failed to provide precise information as to the question of who has control over decryption of personal data. The TOMs merely require the data importer to apply the “commercially available industry standard”. The DPA held that this reference is not precise enough to demonstrate what standard is meant by this wording and if adequate security is ensured. However, the DPA held that Article 49(1)(b) GDPR is applicable in this case. Under Article 49 GDPR, third country data transfers are allowed, in the absence of an adequacy decision or appropriate safeguards pursuant to Article 46 GDPR, only if one of the conditions in Article 49(1) GDPR is fulfilled. According to the DPA, the transfer of personal data to the People’s Republic of China was necessary for the implementation of pre-contractual measures taken at the data subject’s request pursuant to Article 49(1)(b) GDPR. The controller has to transfer the personal data of the data subject to the independent vendor located in a third country in order to fulfil his contractual obligation in the case of a purchase by the data subject. The data subject conducted the purchase on the controller’s platform voluntarily and on his own initiative. According to the DPA, Recital 111 does not prevent the application of Article 49 GDPR in this case. The DPA held that the word “occasional” in Recital 111is to be understood as including “in case of a purchase”. The transfer of personal data occurred only once and not even repeatedly or regularly. The DPA held that the data subject’s request to suspend all data flows of European users lays outside of the subject matter of the case. Moreover, in order for the DPA to impose a suspension, each individual data flow to the third country must be unlawful, which the DPA did not assume at the time being. The DPA rejected the complaint.

### Garante per la protezione dei dati personali (Italy) - 10266250

*Source: Garante per la protezione dei dati personali (Italy), 2026-08-19 — https://overview.legal/posts/291259 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10266250*

Facts — The data subject received unsolicited promotional phone calls and a email containing contractual information from Green Partner (the processor), despite the data subject's phone number being registered with the Public-Opt-Out Registry. The processor failed to respond to the data subjects request to exercise his rights. The data subject had also sought compensation from the processor. The processor dismissed the request with regard to its content and origin due to being subject to repeated fraudulent emails which aimed at soliciting undue payments. On 13 October 2025 the data subject submitted a complaint with the Italian DPA. In the course of the procedure by the DPA, the processor first denied responsibility for the promotional contact made to the data subject, the DPA found that the caller ID number was not registered in the Register of Communications and Postal Operators (‘ROC’). After further questions by the DPA, the processor claimed that the phone call was a mere clerical error made by an agent of the sub-processor (Vanille Service S.r.l.s.) it had engaged in the entry of the phone number. The processor claimed to process data on behalf of Sorgenia (the controller). The controller emphasised that the processor was never authorised to use telemarketing to conduct sales, violating their contractual agreement. The controller denied having any contractual relationship with the sub-processor as they never authorised the use of a sub-processor pursuant to Article 28 GDPR. Holding — The DPA identified a contradictory classification of the controller and the processor, and thus subsequent obligations. The contract presented by the processor declared the parties as independent controllers. Nonetheless, in 2018, the processor accepted to be a processor under Article 28 GDPR. According to the DPA, the contractual relationship was not properly understood by the processor, and correspondingly the GDPR obligations which follow. Firstly, the DPA held that in absence of demonstrating an appropriate legal basis, the promotional contact made by the processor violated Articles 5, 6 and 7 GDPR. Furthermore, the DPA held that the failure by the processor to adopt adequate measures to handle data subject requests concerning the exercise of their rights, and the inadequate response to the request submitted by the data subject, violated Articles 12, 13, 14, 15 and 22 GDPR. Lastly, the DPA found the processor to be in violation of its processor duties in light of its appointment in 2018 under Article 28 GDPR, as it did not diligently assess the arrangement with the controller, and lacked the prior written authorisation for engaging a sub-processor. The DPA imposed an administrative fine of €15,300 on the processor, and ordered it to adopt appropriate measures to ensure that any further engagement of sub-processors complies with the GDPR.

### Meta Platforms Ireland Limited: Insufficient legal basis for data processing

*Source: Data Protection Authority of Ireland, 2023-05-12 — https://overview.legal/posts/47959 — original: https://www.enforcementtracker.com/ETid-1844*

The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 1.2 billion. This is the highest fine imposed to date under the GDPR. In its decision, the DPC found that Meta had violated Art. 46 GDPR by continuing to transfer personal data to the U.S. after the Schrems II ruling of the CJEU. According to the Schrems II ruling, U.S. law does not provide a level of protection for personal data substantially equivalent to that provided by EU law and that the standard contractual clauses (SCCs) al

### NAIH (Hungary) - NAIH-450-7-2026

*Source: NAIH (Hungary), 2026-05-12 — https://overview.legal/posts/184727 — original: https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-450-7-2026*

Facts — The DPA initiated an investigation into the processing of personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The period under review extended from January 2020 to November 2025. During this time, the company had multiple privacy notices in force, as well as other documents that contained relevant information on the processing of personal data. Holding — The DPA found the controller guilty of multiple GDPR violations and issued it a fine of HUF 15,000,000 (€41,500). In addition, it ordered the controller to bring its processing operations in compliance with the GDPR by amending the information system used on its website, in particular the data processing provisions of the general terms and conditions and the data processing notices related to prize contests. First, the DPA held that the controller had violated the principle of transparency laid down in Article 5(1)(a) GDPR: several separate documents contained partially conflicting, irrelevant, and incomplete information regarding the processing of personal data. The information was not organised within a uniform, transparent system. Second, the DPA determined that the controller had failed to provide concise, transparent, and intelligible information regarding the purposes and the legal basis for each processing activity and therefore infringed Article 12(1) GDPR. Finally, the DPA found infringements of Articles 13(1) and 13(2) GDPR – the controller had not provided the data subjects all information necessary when personal data is collected from data subjects. In particular, the controller had failed to adequately distinguish the purposes and the legal bases for each processing operation, recipients of personal data, and retention periods. The controller’s website also contained contradictory information on whether or not personal data was transferred to the United States.

## Recent developments

### What Happened to the Risk-Based Approach to Data Transfers?

*Source: Future of Privacy Forum, 2022-09-27 — https://overview.legal/posts/6271 — original: https://fpf.org/blog/what-happened-to-the-risk-based-approach-to-data-transfers/#entry-912*

The GDPR incorporates the RBA for all obligations of the controller in the GDPR. Where the transfer rules are stated as obligations of the controller (rather than as absolute principles), the RBA of Article 24 therefore applies. Other than the DPAs assume, this is not contradicted by the ECJ in Schrems II nor by the EDPB recommendations on additional measures following the Schrems II judgment, according to Lokke Moerel, Professor of Global ICT Law at Tilburg University and a Dutch Cyber Security

### Three recommendations for a robust data processing agreement in the event of a cyberattack.

*Source: Autoriteit Persoonsgegevens, 2025-11-11 — https://overview.legal/posts/52099*

Well-drafted data processing agreements between organizations help to effectively manage and, in some cases, even prevent cyberattacks. This strengthens the digital resilience of victims of data breaches. However, the Dutch Data Protection Authority (AP) observes that good agreements are often lacking. Based on its research, the AP is therefore providing organizations with three recommendations for creating strong data processing agreements.

### Drie aanbevelingen voor een sterke verwerkersovereenkomst  bij een cyberaanval

*Source: Autoriteit Persoonsgegevens, 2025-11-11 — https://overview.legal/posts/49139 — original: https://autoriteitpersoonsgegevens.nl/actueel/drie-aanbevelingen-voor-een-sterke-verwerkersovereenkomst-bij-een-cyberaanval*

Goede verwerkersovereenkomsten tussen organisaties helpen cyberaanvallen adequaat af te handelen, en soms zelfs te voorkomen. Ze versterken zo de digitale weerbaarheid van slachtoffers van datalekken. Toch schort het nog vaak aan goede afspraken, ziet de Autoriteit Persoonsgegevens (AP). Op basis van onderzoek geeft de AP organisaties daarom drie aanbevelingen voor sterke verwerkersovereenkomsten.

### Strengthening data protection worldwide: EDPB meets with the countries and organisation with an adequacy decision

*Source: European Data Protection Board, 2025-12-03 — https://overview.legal/posts/49123 — original: https://www.edpb.europa.eu/news/news/2025/strengthening-data-protection-worldwide-edpb-meets-countries-and-organisation_en*

Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives of Data Protection Authorities (DPAs) from the countries and the organisation with an EU adequacy decision. This meeting marked the second of its kind, following the first gathering in October 2024. An adequacy decision is a key-mechanism in EU data protection legislation which allows free flow of personal data from Eu

### Hunton geeft een samenvatting van twee artikelen uit de nieuwe SCC-richtlijnen: het onderdeel over "lokale wetgeving en toegang tot overheidsinstanties".

*Source: DataGuidance, 2022-10-18 — https://overview.legal/posts/51831*

Volgens artikel 14 van de Standaard Contractuele Bepalingen (SCC's) voor gegevensuitwisseling, moet de partij die de gegevens importeert een risicoanalyse uitvoeren om te verifiëren of de wet- en regelgeving en praktijken van het ontvangende derde land de mogelijkheid van de gegevensimporteur om te voldoen aan de SCC's voor gegevensuitwisseling, kunnen belemmeren. Indien de risicoanalyse aantoont dat de SCC's voor gegevensuitwisseling op zichzelf niet voldoende zijn om een in wezen gelijkwaardig beschermingsniveau te garanderen voor de persoonsgegevens in het ontvangende derde land, moeten aanvullende waarborgen worden geïmplementeerd, zoals end-to-end-versleuteling.

## Literature

### Unprotected Processing by Default vs Data Protection by Design and by Default Under the GDPR for Schrems II and GDPR

*Source: SSRN Electronic Journal, 2022-01-01 — https://overview.legal/posts/132477 — original: https://doi.org/10.2139/ssrn.4018408*

### GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR

*Source: European Data Protection Law Review, 2017-01-01 — https://overview.legal/posts/132475 — original: https://doi.org/10.21552/edpl/2017/4/12*

ED P L 4 | 2 0 1 7 5 0 0 R ep o r t s G D P R I m p l e m e n t at i o n S e r i e s U n i t ed K i n gd o m : H ead i n g T o w ar d s B r exi t b u t w i t h a D at a P r o t ect i o n B i l l I m p l em en t i n g G D P R L o r n a W o o d s * I . I n t r o d u c t i o n F o l l o w i n g o n f r o m i t s S t a t e m e n t o f I n t e n t , t h e B r i t i s h G o v e r n m e n t h a s p u b l i s h e d t h e D a t a P r o t e c t i o n B i l l w i t h t h e i n t e n t i o n o f m e e t i n g t h e E u r o p e a n U n i o n G e n- e r a l D a t a P r o t e c t i o n R e g u l a t i o n 1 ( G D P R ) t i m i n g o f M a y 2 0 1 8 . A f t e r B r e x i t , t h e G D P R w i l l b e i n c o r p o r a t e d i n t o t h e U K ’ s d o m e s t i c l a w u n d e r t h e E U ( W i t h d r a w a l ) B i l l , c u r r e n t l y b e f o r e t h e U K P a r l i a m e n t . 2 O n e o f t h e k e y c o n c e r n s o f t h e U K G o v e r n m e n t 3 i s t o e n s u r e t h a t t h e U K g e t s a n a d e q u a c y a g r e e m e n t b y t r y i n g t o e n s u r e t h e D a t a P r o t e c t i o n B i l l ( t h e D P B i l l ) 4 p r o v i d e s a ‘ b r o a d- l y e q u i v a l e n t ’ l e v e

### If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

*Source: Computer law & security review, 2026-01-23 — https://overview.legal/posts/53843 — original: https://doi.org/10.1016/j.clsr.2025.106251*

As the General Data Protection Regulation (GDPR) approaches its tenth anniversary, the European legislator is considering reforms thereto. This article offers a set of research-based suggestions for what such reforms could look like, based on two assumptions. First, that the GDPR is overall a solid piece of legislation that upholds the enduring objectives and principles of data protection law. Second, that any improvement cannot compromise the level of protection of fundamental rights currently

### Council of Europe ∙ Convention 108+, the GDPR, and Data Processing in the National Security Domain

*Source: European Data Protection Law Review, 2022-01-01 — https://overview.legal/posts/132483 — original: https://doi.org/10.21552/edpl/2022/3/14*

### GDPR Implementation Series ∙ Austria: A Brief Overview Concerning the Implementation of the GDPR

*Source: European Data Protection Law Review, 2017-01-01 — https://overview.legal/posts/132489 — original: https://doi.org/10.21552/edpl/2017/2/12*

## Related topics

- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data
- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Law Enforcement** — https://overview.legal/topics/law-enforcement
  Processing for law enforcement purposes

---
Generated by overview.legal · https://overview.legal/topics/processing-agreement · 2026-10-13