Law Enforcement Directive·Recital 55
Recital (55)
Recitals 55 / 107
The carrying-out of processing by a processor should be governed by a legal act including a contract binding the processor to the controller and stipulating, in particular, that the processor should act only on instructions from the controller. The processor should take into account the principle of data protection by design and by default.