Common use of Processing by Processor in a Clause in Contracts

Processing by Processor in a. third country with poor data protection security. If the processing of the data by the Processor takes place exclusively or also in a third country with poor data protection security, the EU standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU standard contractual clauses 2021”) shall apply in respect of such processing. The selection of the module of these EU standard contractual clauses 2021 applicable to the processing shall be made in Attachment 1. Controller and Processor shall cooperate closely in documenting compliance with the obligations resulting from the EU standard contractual clauses 2021. In order to meet the criteria set out in Clause 14 of the EU standard contractual clauses 2021, the Processor shall provide the Controller with all information required in this respect. In particular, the Processor shall answer the Controller’s questions truthfully, comprehensively and within a reasonable period of time regarding the applicability of legal provisions and practices or their practical implementation in the relevant third countries with poor data protection security. If, due to the legal provisions and practices in these third countries with poor data protection security and in view of the particular circumstances of the processing, there is no reasonable assurance that the processing will be carried out in compliance with the EU standard contractual clauses 2021, the Processor shall, in consultation with the Controller, (i) implement additional technical and organizational measures and/or (ii) provide additional contractual assurances, which, taking into account these legal provisions and practices and the particular circumstances of the processing, provide a sufficient guarantee for the processing of the data in compliance with the Processor’s obligations under the EU standard contractual clauses 2021 (“Additional Measures and Assurances”). The processing of the data by the Processor may only start after the Controller’s questions mentioned in paragraph 2 have been answered by the Processor and after the Additional Measures and Assurances possibly required according to paragraph 3 have been taken or given.