Recital 39a

Source: ST 12535/26, page 33

Also numbered 39aITRE–LIBE amendment 387 (CJ72-AM-790967, pages 154–155) proposes a different recital 39a. The tracker keeps it as a separate provision: Recital 39a (new).

Changes since18 June 2026ST 10677/26, Recital 39a

Same wording as in the Council text of 18 June 2026. Every text of this provision

Text as printed

Same wording since 10 June · Changes since the Commission proposal

In order to facilitate compliance obligations and the establishment of the contract or other legal act governing the processing by a processor on behalf of the controller, the processor should also be subject to the general obligation of data protection by design and by default under Regulation (EU) 2016/679 to extent it relates to their own obligations under that Regulation. This obligation does not affect the level of responsibility and relationship between the controller and processor, nor does it affect the principle of accountability or the respective obligations of controller and processor as laid down under Article 28 of Regulation (EU) 2016/679). Accordingly, the controller remains solely responsible for determining the purpose and means of processing and for complying with related obligations, while the processor should ensure that data protection by design and by default is applied to its offered means and services to carry out processing.