The data processor. Catalan Data Protection Authority

What is the deadline for adapting all processing agreements formalised before 25 May 2018 to the GDPR?

In accordance with transitional provision five of the new Spanish Personal Data Protection Act (the LOPDGDD), processing contracts and agreements established before 25 May 2018 remain in force until their envisaged expiry date.

In the case of agreements with an indefinite duration, they shall remain valid until 25 May 2022.

In any case, during the term of the contract or agreement, either party may require the other to modify the contract in order to adapt it to the provisions of Article 28 of the GDPR.

Is a laboratory that performs analyses sent to it by a hospital the data controller or processor?

If the hospital decides which laboratory will perform the analyses it needs and which analytical tests need to be performed, and provides the laboratory with the information needed to identify them, the laboratory is considered to be the processor. It may use the data for the purpose indicated by the controller and in accordance with the instructions of the latter, and may store them for as long as necessary for the provision of the services and, where appropriate, as long as responsibilities may be derived from the execution of the service.