# Processing by entities other than data fiduciaries

# Bare Act

# Section 31(1)

The data fiduciary shall not engage, appoint, use or involve a data processor to process personal data on its behalf without a contract entered into by the data fiduciary and such data processor.

# Section 31(2)

The data processor referred to in sub-section (1) shall not engage, appoint, use, or involve another data processor in the processing on its behalf, except with the authorisation of the data fiduciary and unless permitted in the contract referred to in sub-section (1).

# Section 31(3)

The data processor, and any employee of the data fiduciary or the data processor, shall only process personal data in accordance with the instructions of the data fiduciary and treat it confidential.

# Explanation

# Exemption

  1. Section 31 is not applicable to "small entity" (Ref:Section 39(1))
Last Updated: 12 Dec 2019