On October 7, 2024, the European Data Protection Board (EDPB) adopted Opinion 22/2024 (the “Opinion”) at the request of the Danish Data Protection Authority. The Opinion clarifies the obligations of data controllers (entities that determine the purposes and means of processing personal data) when delegating processing operations to processors and sub-processors, detailing the requirements for compliance with Article 28 of the GDPR (concerning contracts and conditions for hiring processors) and aiming to ensure a harmonized application of these obligations across EU Member States.

In this Briefing, we cover the main points of the Opinion.