May 25, 2022 was the deadline for adapting data processing contracts signed before 25 May 2018 to the current law. Consequently, as of yesterday, all data commissioning contracts currently in force must comply with the obligations provided for in both Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights ("LOPDGDDD").

Pursuant to the 5th Transitional Provision LOPDGDD, data processing assignment contracts signed before the entry into force of the GDPR, i.e. before 25 May 2018, continued to be valid and effective for four years, i.e. until 25 May 2022. Furthermore, these contracts remained subject to the provisions of the previous law, the Personal Data Protection Act 15/1999 of 13 December 1999.

As of 25 May 2022, these processing contracts must comply with the obligations established in the GDPR and the LOPDGDDD. In this regard, the contracts must cover the purpose, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the responsible party. Furthermore, the contracts shall specify that the processor shall process personal data only on the instructions of the responsible party, ensure that persons authorized to process personal data are subject to confidentiality agreements, implement appropriate security measures to ensure a level of security appropriate to the risk, assist the responsible party in the event that the interested parties exercise their rights pursuant to the data protection law, erase or return the processed data upon termination of the provision of services and, finally, undertake to make available to the responsible party all information required to demonstrate compliance with its data protection obligations.

Florencia Arrébola
IP/Media Area