A controller engages a cloud vendor that processes personal data solely on oral instructions with no written contract containing GDPR processor terms. What is the accountability problem?
Select an answer to reveal the explanation.
Short Explanation
Hiring a cloud crew on a handshake with no playbook is how privacy chores fall through the cracks. Article 28 wants a binding contract with the mandatory clauses — not hallway instructions. Transfers are a separate chapter; processor deals still need the paperwork.
Full Explanation
Article 28(3) requires processing by a processor to be governed by a contract or other legal act under Union or Member State law that is binding and sets out required elements (instructions, confidentiality, security, sub-processors, assistance, deletion/return, audits). Oral-only arrangements do not meet that standard. Absence of a contract does not license the processor to determine purposes as a controller by default. Transfer tools do not replace Article 28 processor contracts.