Processors

Germany: Monitoring and auditing obligations of controllers with respect to their processors

By Verena Grentzenberg & Ali Umutlu on April 16, 2025

Posted in EU privacy, General Data Protection Regulation, Privacy Law, Processors

In a decision on immaterial damages under Article 82 of the EU General Data Protection Regulation (GDPR), the Higher Regional Court of Dresden, Germany (case number 4 U 940/24), set out important monitoring and auditing obligations of controllers with respect to their processors.

The controller (defendant) operates an online music…

EU: Engaging vendors in the financial sector: EDPB clarifications mean more mapping and management

By Linzi Penman, Eilis McDonald & Megan Ho on November 8, 2024

Posted in EDBP (European Data Protection Board), EU data governance, EU privacy, General Data Protection Regulation

The European Data Protection Board (“EDPB“) adopted an opinion on 7 October 2024, providing guidance for data controllers relying on processors (and sub-processors) under the GDPR. The two key themes are:

supply chain mapping;
verifying compliance with flow-down obligations.

For many financial institutions, the emphasis on these obligations should not come as a…