Art. 33 Organic Law 3/2018 allocates further rights to the controller regarding personal data. Controllers can decide whether they or the processors should be the primary contact for data subjects. Moreover, after the provision of services has ended, the controller may have his or her personal data transferred to a third controller.
The fifth transition clause of the Organic Law 3/2018 deems data processing agreements entered into before 25 May 2018 valid until 25 May 2022.
Guidelines of the supervisory authorities
The AEPD has issued additional guidelines on commissioned processing.
