Art. 9 NL accreditation requirements for GDPR code of conduct monitoring bodies

Explanatory note: Monitoring bodies could engage subcontractors. The requirements below set out the relevant safeguards for engaging subcontractors. In order to demonstrate these safeguards the monitoring body will need to provide documented evidence. Requirements: When the monitoring body engages a subcontractor to fulfil some of its tasks, the monitoring body remains responsible for all activities sub-contracted. The monitoring body shall specify the tasks and roles that the subcontractors will carry out when it applies for accreditation. The monitoring body shall demonstrate that the subcontractor satisfies all relevant requirements set out in this decision and in particular requirements 1; 2; 3; 8.5. The monitoring body shall demonstrate that the subcontractor is effectively bound by these requirements and can deliver compliance on them. Without prejudice to requirement 6.3, the monitoring body shall have a procedure in place to communicate to the AP without delay all substantial changes relating to a subcontractor that have an impact on the organisation and/or structure of the monitoring body which could affect its ability to perform its function effectively. Such substantial changes may include: the termination of the agreement with the subcontractor; the replacement of the subcontractor by a new one.

Subcontractors

Rechtspraak bij dit artikel