GDPR processorsous-traitant au sens du RGPD

Processing carried out by a processor must be governed by a contract or other legal act in writing, including in electronic form (article 28, paragraphs 3 and 9). The act sets out the subject matter and duration of the processing, its nature and purpose, the type of personal data and the categories of data subjects. It also requires the processor to process data only on documented instructions from the controller (article 28, paragraph 3).

The CNIL lists IT service providers, including hosting and maintenance, among processors. It does not name software publishers as such. The role therefore depends on what the publisher actually does for the practice, such as hosting, remote access or maintenance.

Where a publisher processes the practice’s data on the practice’s behalf, a contract that meets article 28 is required.