The course provides a clear overview of the requirements for private and public organizations to control their data processors. In addition, various practical approaches and experiences are discussed to ensure documentation for the control carried out.

Topics include:

• The Data Protection Regulation’s requirement to take care of a risk-based approach
• The Norwegian Data Protection Authority’s guidance
• The importance of certain key terms in the data processing agreement for the execution of the control
• The various practical options for actually carrying out checks are reviewed. Blue. use of audit statements and the possibilities to carry out checks yourself
• A risk-based concept for the most central control is presented