The diagram below encapsulates a brief history of the legislative progress of
GDPR Art.28(3)(h) and the final subparagraph of Art.28(3), and a processor's o
bligation to "immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions". Click on the image to enlarge it.
From a separate sub-paragraph, to same level indented, joined in the same paragraph, separated out again... but that can change the meaning!
For the links to these travaux preparatoires documents, and discussion of this and other controller/processor contract and liability issues in response to the UK ICO's recent consultation, please see my SCL article.
