Consultation on draft guidance for contracts with data processors under the GDPR

Close date: 10 October 2017

The Information Commissioner's Office (ICO) consults on draft guidance intended to help data controllers understand their responsibilities and liabilities under the General Data Protection Regulation (2016/679 EU) (GDPR) when appointing data processors. Data controllers must appoint data processors only where they can provide "sufficient guarantees" that the requirements of the GDPR will be met and the rights of data subjects protected. The draft guidance sits alongside the ICO's Overview of the GDPR and explains the provisions that must be included in contracts between data controllers and data processors. The GDPR comes into effect on 25 May 2018.

Consultation document: Consultation on GDPR guidance on contracts and liabilities between controllers and processors