Common use of Authority of the Controller Clause in Contracts

Authority of the Controller. (1) 1The Processor shall process personal data only in accordance with the agreements made and following the instructions of the Controller, unless he is obliged to process otherwise by law of the Union or of the Member States to which the Processor is subject (Art. 28 (3) 3 lit. a, Art. 29 GDPR). 2In the event of such an obligation, the Processor shall inform the Controller of these legal requirements prior to processing, unless the law prohibits such notification on grounds of a prevailing public interest. (2) 1The Processor warrants that the processing will be carried out in accordance with the instructions of the Controller. 2If the Processor is of the opinion that an instruction of the Controller violates this Agreement or applicable data protection law, he must inform the Controller immediately. 3Following a corresponding notification to the Controller, the Processor is entitled to suspend the execution of the instruction until the Controller confirms or changes the instruction. 4The parties agree that the sole responsibility for the processing according to instructions lies with the Controller. (3) 1Controller's instructions are always in written or text form. If necessary, the Processor can also give verbal instructions (remotely). 2Oral instructions are to be confirmed by the Controller immediately in written or text form. (3) sentence 2 lit. g GDPR (1) 1Copies or duplicates of the data are not made without the knowledge of the Controller. 2Excluded from this are backup copies, to the extent necessary to ensure proper data processing, as well as data copies required with regard to compliance with statutory retention requirements. (2) 1After the conclusion of the contractually agreed work or sooner upon request by the Controller - at the latest upon termination of the Main Agreement - the Processor has all documents, processing and utilization results as well as data, which are related to the contractual relationship to hand over to the Controller or to destroy it after prior consent in accordance with data protection law. 2The same applies to test and reject materials. 3The log of the deletion must be submitted on request. (3) 1Documentations serving as proof of orderly and proper data processing shall be kept by the Processor according to the respective retention periods beyond the end of this Agreement. 2He may hand them over to the Controller for his discharge at the end of this Agreement.