Extract to table

Consistent with Article 28(3)(a) of the GDPR, Lumos is required to process personal data only on documented instructions from the data exporter, including with regard to transfers of personal data to a third country

The DPA specifies that the Agreement and the DPA themselves constitute the data exporter's initial documented instructions, and that any additional instructions must be provided in writing and agreed upon by the parties

If Lumos believes that an instruction infringes the GDPR or other applicable data protection law, it must inform the data exporter immediately

The DPA employs the general authorization model with an objection mechanism: Lumos must provide Meridian with at least thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor

Lumos must make available to the data exporter all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and must allow for and contribute to audits conducted by the data exporter or an independent auditor mandated by the data exporter

Meridian GmbH, as an entity established in the EU, should assess independently whether it is required to appoint a DPO under Article 37 based on the nature and scale of its processing activities