French law · Prepare your case, step by step
GDPR processor agreement in France
A GDPR processor agreement should describe the actual service, personal data and controller’s instructions. The contract title alone does not determine the parties’ roles. Use this review grid to distinguish written provisions from gaps and questions, including further processors and the end of the service. It prepares a document review without certifying GDPR compliance or classifying every party automatically.
Go to the organiserHow should the five review priorities be read?
Reading order: role and scope before performance safeguards. This is a review method, not a legal ranking of severity.
Identify roles
Establish who actually decides processing purposes and means.
Describe the service
Link the service to the data and people concerned.
Locate instructions
Find where documented instructions are defined.
Identify further processors
Match providers to the subcontracting provisions.
Prepare the end of service
Locate return, deletion and unresolved information.
How can I prepare my document review?
This organiser assembles your choices on this page. Fields are not sent automatically and are not retained after reloading.
Controller, joint-controller and processor roles depend on actual decisions about processing, rather than the contract label. Record the relevant passage and any missing information.
What is missing in the backup example?
A small business outsources hosting of customer requests. Its data schedule describes the records but not backups handled by another provider.
- Document
- Service agreement and data schedule
- Question
- Why describe the actual processing service?
- Next check
- Separate the provider’s role from the further-processor issue and locate the provision covering backups.
Separate the provider’s role from the further-processor issue and locate the provision covering backups.
Which distinctions change the document review?
| Situation | Purpose | Record to examine |
|---|---|---|
| Service agreement | Define the service being supplied | Scope, responsibilities and commercial terms |
| Processor schedule | Organise processing for the controller | Instructions, data, security and end-of-service arrangements |
Does the contract title determine a party’s GDPR role?
Controller, joint-controller and processor roles depend on actual decisions about processing, rather than the contract label.
Source 1 ↗Why describe the actual processing service?
A binding written arrangement must explain the service and how GDPR duties work in practice; repeating the regulation is insufficient.
Source 1 ↗Which operations belong in the data schedule?
Data categories, instructions, subprocessors and end-of-service handling need specific treatment; CNIL sample clauses alone are not a complete agreement.
Source 2 ↗Which records describe the outsourced processing?
Locate and reconcile these records: Service agreement and data schedule ; Data, data-subject and purpose inventory ; Subprocessor list and security measures. Mark missing or uncertain records explicitly.
- Service agreement and data schedule
- Data, data-subject and purpose inventory
- Subprocessor list and security measures
What should I know before acting?
Does the contract title determine a party’s GDPR role?
Controller, joint-controller and processor roles depend on actual decisions about processing, rather than the contract label.
Source 1 ↗Why describe the actual processing service?
A binding written arrangement must explain the service and how GDPR duties work in practice; repeating the regulation is insufficient.
Source 1 ↗Which operations belong in the data schedule?
Data categories, instructions, subprocessors and end-of-service handling need specific treatment; CNIL sample clauses alone are not a complete agreement.
Source 2 ↗Which records describe the outsourced processing?
Locate and reconcile these records: Service agreement and data schedule ; Data, data-subject and purpose inventory ; Subprocessor list and security measures. Mark missing or uncertain records explicitly.
Source 1 ↗Source 2 ↗What is missing in the backup example?
Fictional example. A small business outsources hosting of customer requests. Its data schedule describes the records but not backups handled by another provider. Separate the provider’s role from the further-processor issue and locate the provision covering backups.
Why is a CNIL example not a complete agreement?
Avoid these shortcuts: Treating every supplier as a processor ; Assuming an Article 28 schedule itself authorises international transfers.
Source 1 ↗Source 2 ↗How should the five review priorities be read?
Reading order: role and scope before performance safeguards. This is a review method, not a legal ranking of severity. Separate the provider’s role from the further-processor issue and locate the provision covering backups.
What can Julie help examine in this schedule?
Julie can explain the cited French-law sources and help examine the selected document issue. Bring this specific question: Why describe the actual processing service? Keep uncertain facts marked and obtain professional review of consequential decisions.
How can I continue with Julie?
Continue with Julie: sourced questions, document analysis and assisted drafting.