The controller must use only processors that provide: Under data protection obligations on controllers, what

A controller must use only processors that give sufficient guarantees and bind them by a written contract, while remaining accountable.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. The controller must use only processors that provide sufficient guarantees and bind them by a written contract ✓

   Correct: the controller must select processors offering sufficient guarantees and govern the processing through a binding written contract.
2. The controller fully transfers all of its data protection responsibilities to the processor upon signing

   Plausible but wrong: engaging a processor does not discharge the controller's own accountability for the data.
3. The controller has no obligations because the processor alone becomes accountable for all the processing

   Plausible but wrong: the controller remains accountable and must ensure the processor meets requirements.
4. The controller may freely ignore where the processor stores data because location never affects its obligations

   Plausible but wrong: storage location can trigger cross-border transfer duties, so it cannot be ignored.

How to remember it

A controller must use only processors that give sufficient guarantees and bind them by a written contract, while remaining accountable.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Collecting only the personal data that is adequate: Which practice best reflects that principle? →
• It is a special category of data whose processing is: Under the GDPR, how is the biometric data used for that →
• Reproducing copyrighted works to assemble a training set: Which intellectual-property consideration most →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →