Data Security 7

Management of Relations with Data Processors

Some data controllers receive services from data processors to meet their information technology needs.  Data controllers should make sure that the data processors provide at least as much security as their own personal data while receiving services. Because data processors are also responsible for ensuring the security of personal data, together with the data controller.

👇👇👇Click Read more

The contract signed with the data processor must be in writing, and the data processor must comply with the data processing purpose and scope specified in the contract, only in line with the instructions of the data controller. At the same time, it is recommended that it contains a provision that it will act in accordance with the legislation on the protection of personal data and that it is in accordance with the Personal Data Retention and Destruction Policy.

It is important to include in this agreement that the data processor will be subject to an indefinite confidentiality obligation regarding the personal data it processes.

Again, in case of any data breach in the said contract, it should be stated that the data processor is obliged to immediately notify the data controller of this situation. This will be beneficial for the data controller to fulfill its obligation to immediately notify the Personal Data Protection Board and the person concerned about this violation.

Also; To the extent that the nature of the contract between the parties permits this, it will be beneficial for the data processor to fulfill its obligation to ensure data security, if the categories and types of personal data transferred by the data controller to the data processor are specified in a separate article.

In addition, the data controller performs or has had the necessary audits done on the system containing personal data, and can examine the reports and the service provider on site.