A GDPR Carol

They've wished us a GDPR, they've wished us a GDPR
They've wished us a GDPR – and a very long year
Good guidance we need, but what will we see?
They've wished us a GDPR – and a very long year!
And we won't sleep until we've got some, we won't sleep until we've got some -
We're weeping because we've got some (!) – and a very long year
[Repeat ad nauseam:]
They've wished us a GDPR, they've wished us a GDPR
They've wished us a GDPR – and a very long year…

© Kuan Hon licensed under Creative Commons CC BY 2.0 so share if you wish! https://creativecommons.org/licenses/by/2.0/

GDPR - processor to "immediately inform" - indentation matters!

The diagram below encapsulates a brief history of the legislative progress of GDPR Art.28(3)(h) and the final subparagraph of Art.28(3), and a processor's obligation to "immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions". Click on the image to enlarge it.

From a separate sub-paragraph, to same level indented, joined in the same paragraph, separated out again... but that can change the meaning!

For the links to these travaux preparatoires documents, and discussion of this and other controller/processor contract and liability issues in response to the UK ICO's recent consultation, please see my SCL article.