Common use of Instructions by Customer Clause in Contracts

Instructions by Customer. 3.1. Service Provider shall process the Customer Personal Data in accordance with the documented instructions of Customer within the meaning of article 28 GDPR, unless Service Provider is by applicable law required to do otherwise. In the latter case, Service Provider shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. 3.2. The instructions of Customer are in principle conclusively stipulated and documented in this DPA. Deviating individual instructions or instructions which impose additional requirements shall be consulted beforehand with Service Provider to assess feasibility and estimate the costs. Any additional costs incurred by Service Provider as a result of deviating individual instructions or instructions which impose additional requirements shall be borne by Customer. 3.3. Notwithstanding anything contrary in this DPA, Customer shall serve as a single point of contact for Service Provider and is solely responsible for the internal coordination, review and submission of instructions or request of other controllers (belonging to Customer group of companies) to the Service Provider. Service Provider shall be discharged of its obligation to inform or notify a controller when it has provided such information or notice to Customer. Similarly, Service Provider is entitled to refuse any instructions provided directly by a controller that is not the Customer. Service Provider will serve as a single point of contact for Customer and is solely responsible for the internal coordination, review and submission of instructions or requests from Customer to Service Provider’s sub-processor(s). 3.4. If Service Provider is of the opinion that an instruction from Customer infringes this DPA or applicable data protection law, Service Provider is after correspondingly informing Customer entitled but not obliged to suspend the execution of the instruction until Customer confirms the instruction. The Parties agree that the sole responsibility for the lawfulness of processing (as within the meaning of article 6 GDPR) Customer Personal Data lies with Customer.

Instructions by Customer. 3.1. Service Provider shall process the Customer Personal Data in accordance with the documented instructions of Customer within the meaning of article 28 GDPR, unless Service Provider is by applicable law required to do otherwise. In the latter case, Service Provider shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. 3.2. The instructions of Customer are in principle conclusively stipulated and documented in this DPA. Deviating individual instructions or instructions which impose additional requirements shall be consulted beforehand with Service Provider to assess feasibility and estimate the costs. Any additional costs incurred incurr ed by Service Provider as a result of deviating individual instructions or instructions which impose additional requirements shall be borne by Customer. 3.3. Notwithstanding anything contrary in this DPA, Customer shall serve as a single point of contact for Service Provider and is solely responsible for the internal coordination, review and submission of instructions or request of other controllers (belonging to Customer group of companies) to the Service Provider. Service Provider shall be discharged of its obligation to inform or notify a controller when it has provided such information or notice to Customer. Similarly, Service Provider is entitled to refuse any instructions provided directly by a controller that is not the Customer. Service Provider will serve as a single point of contact for Customer and is solely responsible for the internal coordination, review and submission of instructions or requests from Customer to Service Provider’s sub-processor(s). 3.4. If Service Provider is of the opinion that an instruction from Customer infringes this DPA or applicable data protection law, Service Provider is after correspondingly informing Customer entitled but not obliged to suspend the execution of the instruction until Customer confirms the instruction. The Parties agree that the sole responsibility for the lawfulness of processing (as within the meaning of article 6 GDPR) Customer Personal Data lies with Customer.