A controller engages a cloud vendor that processes personal data solely on oral instructions with no written contract containing GDPR processor terms. What is the accountability problem?
Select an answer to reveal the explanation.
Short Explanation
Hiring a cloud crew on a handshake with no playbook is how privacy chores fall through the cracks. Article 28 wants a binding contract with the mandatory clauses — not hallway instructions. Transfers are a separate chapter; processor deals still need the paperwork.
Full Explanation
Article 28 requires controllers to use only processors that provide sufficient guarantees and to govern the relationship by a contract or other legal act under Union or Member State law that binds the processor to documented instructions and enumerated GDPR terms. Oral-only cloud arrangements fail that duty even if both parties are well-intentioned. Municipal IT and private product teams must lock processor terms before personal data flow—not after.
Oral instructions do not satisfy Article 28 merely because both parties are in the EEA. Without a contract, processors must not set their own purposes; doing so risks becoming controllers. Contracts are required for processor engagements generally, not only when international transfers occur (transfers need additional tools).
Exam caveat: Article 28 content includes subject matter, duration, nature/purpose, data types, obligations such as confidentiality, security, sub-processing rules, assistance with rights, and deletion/return.
Operational check: execute a written DPA before onboarding, flow down sub-processor controls, inventory oral legacy vendors and remediate, and block procurement completion without Article 28 schedules attached.