Digital Omnibus proposal· Recital 39a

In order to facilitate compliance obligations and the establishment of the contract or other legal act governing the processing by a processor on behalf of the controller, the processor should also be subject to the general obligation of data protection by design and by default under Regulation (EU) 2016/679 to extent it relates to their own obligations under that Regulation. This obligation does not affect the level of responsibility and relationship between the controller and processor, nor does it affect the principle of accountability or the respective obligations of controller and processor as laid down under Article 28 of Regulation (EU) 2016/679). Accordingly, the controller remains solely responsible for determining the purpose and means of processing and for complying with related obligations, while the processor should ensure that data protection by design and by default is applied to its offered means and services to carry out processing.