The controller must use only processors that provide: Under data protection obligations on controllers, what

A controller must use only processors that give sufficient guarantees and bind them by a written contract, while remaining accountable.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. The controller must use only processors that provide sufficient guarantees and bind them by a written contract ✓

   Correct: the controller must select processors offering sufficient guarantees and govern the processing through a binding written contract.
2. The controller fully transfers all of its data protection responsibilities to the processor upon signing

   Plausible but wrong: engaging a processor does not discharge the controller's own accountability for the data.
3. The controller has no obligations because the processor alone becomes accountable for all the processing

   Plausible but wrong: the controller remains accountable and must ensure the processor meets requirements.
4. The controller may freely ignore where the processor stores data because location never affects its obligations

   Plausible but wrong: storage location can trigger cross-border transfer duties, so it cannot be ignored.

How to remember it

A controller must use only processors that give sufficient guarantees and bind them by a written contract, while remaining accountable.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Data governance: Under the EU AI Act, which core requirement does this practice implement? →
• A design-defect claim: Under product-liability law, which theory most directly fits? →
• Engaging in a prohibited AI practice under Article 5: Which type of infringement attracts the highest maximum →
• All 125 Understanding How Laws, Standards and Frameworks Apply to AI questions →