Appendix: Data Processing Contract

The Data Controller must have a Data Processing Contract with any third-party with whom the Data Controller shares video surveillance media with, with the exception of sharing video surveillance media with law enforcement.

If an organization outsources all or part of its video surveillance activities to a third-party (a Data Processor), it remains liable for compliance with GDPR as a Data Controller. For example, security guards monitoring live surveillance video in the reception area of an organization working for a private company to whom the organization outsourced the task of live monitoring. In this case, the organization must ensure that the security guards carry out their activities in compliance with the provisions GDPR.

For a sample template of a Data Processing Contract, see the Milestone Data Processing Contract template.

Disclaimer: The sample Data Processing Contract must be checked by the Controller. GDPR compliance using this sample is his area of responsibility.