Data processors

All data processors must keep a record of all categories of processing activities carried out on behalf of a controller, containing:

• the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and the data protection officer if there is one;

• the categories of processing carried out on behalf of each controller;

• where applicable, transfers of personal data to a third country or an international organisation; and

• where possible, a general description of their technical and organisational security measures.