SCHEDULES
SCHEDULE 1The data protection principles
Part IIInterpretation of the principles in Part I
The seventh principle
12
Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller is not to be regarded as complying with the seventh principle unless—
a
the processing is carried out under a contract—
i
which is made or evidenced in writing, and
ii
under which the data processor is to act only on instructions from the data controller, and
b
the contract requires the data processor to comply with obligations equivalent to those imposed on a data controller by the seventh principle.