3. Agree on processing
If the hobby organiser uses a third party for the processing of personal data, the organiser must ensure that a written processing agreement is signed with them. Making an agreement ensures that the controller’s obligations will be fulfilled also when the personal data is being processed by a third-party processor on behalf of the hobby organiser.
Before drawing up the agreement, you should define the roles related to the processing: who is the controller and who the processor processing data on behalf of the controller. For example, a payroll clerk who calculates and pays the wages of club employees can be a processor. In this situation, the hobby organiser is the controller, since it determines who receives wages and on what grounds.
The controller can only outsource the processing of personal data to processors that have adequate safeguards in place for ensuring data security.
In the agreement, the controller and processor agree on how the processor must process and secure the personal data. The agreement must specify the object and duration of the processing, nature and purpose of the processing, type of personal data and groups of data subjects, as well as the controller’s obligations and rights. The processor must also ensure that its employees with access to the personal data only process it according to the controller’s instructions.
