Amendment 374· Digital Omnibus proposal Recital 38a (new)

(38a)To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. If processing by a processor is governed by an agreement with the controller which specifies the subject matter and duration of the processing, the nature and purpose of the processing, the types of data to be processed and the categories of data subjects the tasks and duties of the processor shall be directly qualified by this Regulation in order to avoid legal uncertainty and provide clear standards for all parties, which process personal data within the scope of European law. Furthermore, if the processor provides a binding assurance as to the level of protection to which it is able to ensure the security of the processing and its obligation to assist the controller by means of appropriate technical and organisational measures and confirms the suitability of these safeguards for the processing operations it intends to carry out, due to the nature of these services as mere digital infrastructure Services their agreements may renounce on some specific notification requirements of controllers. However, processors who fail to fulfil those assurances are directly liable for this non compliance. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.