Common use of Processing on behalf of the Controller Clause in Contracts

Processing on behalf of the Controller. (1) The Processor shall Process Personal Data on behalf of the Controller only within the scope of the Contract on the Controller’s documented instructions, unless statutory obligations require the Processor to Process Personal Data otherwise. (2) The Controller’s instructions are generally implemented in the Contract. Subsequent instructions are given through the use of agreed technical features and configuration options of the services and products made available by the Processor. Should additional instructions issued otherwise by the Controller result in additional implementation efforts of the Processor, such efforts shall be compensated for by the Controller according to the Processor’s then current rates on a time and material basis. (3) Additional instructions must be issued in writing or in an electronic format (text form). Verbal additional instructions must be confirmed by Controller in writing or in text form immediately. (4) If the Processor considers an instruction to violate applicable data protection laws, it shall inform the Controller immediately and be entitled to suspend the execution of the relevant instructions until the Controller confirms or changes them.