Hardly any company processes personal data using only its own resources. Cloud storage, CRM, payroll, newsletters and IT support run through service providers. Swiss law calls this processing on behalf (Auftragsbearbeitung), the GDPR processing by a processor.
The Swiss rule
Under Art. 9 FADP the controller may assign processing to a processor by contract or law if the processor only processes the data as the controller itself would be allowed to, and no statutory or contractual duty of confidentiality prevents it. The controller must ensure the processor can guarantee data security. The processor may engage sub-processors only with the controller’s prior authorisation.
The GDPR rule
Art. 28 GDPR requires a contract with defined minimum content: subject matter and duration, nature and purpose of processing, data categories and data subjects, processing only on instructions, confidentiality, technical and organisational measures, rules for sub-processors, assistance with data subject rights, deletion or return at the end and audit rights.
Distinction
Not every collaboration is processing on behalf. Anyone processing data for their own purposes, such as a bank, a lawyer or a tax adviser acting under their own professional duties, is usually a controller themselves. The classification decides which contract is needed and who bears which duties.
Practice
A complete list of processors belongs in the record of processing. With providers abroad, transfers abroad come into play, and with US providers also the CLOUD Act. Contract review is covered in our data processing agreement checklist.