Have Questions About the GDPR?

Generally speaking, each third-party entity and/or organization that an investment advisor shares EU personal data with to process on a firm's behalf is a processor.

Is a processing addendum required when a controller shares personal data with a third party? In general, the GDPR requires that controllers, and relevant third parties with whom controllers share personal data with, amend their current agreements with a Data Processing Addendum (DPA) to memorialize certain representations and obligations as required under the GDPR.

As the industry continues to develop, we have observed that there are currently two variations of this agreement in the investment advisory space: a controller-controller agreement and a controller-processor agreement.

What kinds of provisions are generally required in third-party processing addendums? The GDPR has a minimum of 13 provisions that must be included in a DPA. These provisions include: 1. A description of the processing activity including the subject matter, duration, nature and purpose of the processing activity; as well as the type and categories of the personal data being processed; 2. The processing activity instructions; 3. Confidentiality provisions; 4. Identification and implementation of processor's security measures and controls; 5. Authorization for the processor to use subcontractors to process personal data; 6. Identification of obligations that may be inherited by subcontractors to process the personal data; 7. Liability of subcontractors; 8. Procedures connected to responding to data subject requests; 9. Representations by the processor to cooperate with the controller in the event of a data breach; 10. Representations by the processor to cooperate with the controller in performing data protection impact assessments ("DPIA") (as applicable); 11. Controls and representations concerning the return or deletion of personal data; 12. Controllers audit rights; and, 13. Controls governing cross-border transfers of personal data.

Thomas D. Giachetti is chairman of the Securities Practice Group of Stark & Stark. He is a regular contributor to Investment Advisor. He can be reached at [email protected].