Per Iowa Code 715D.7 ICDPA imposes contractual requirements on the relationship between controller and processor. (1) Processor Obligations: a processor shall adhere to the instructions of a controller and shall assist the controller in meeting the controller obligations under this chapter by following the directions of the controller. (2) Contract Required: a contract between a controller and a processor shall govern the processor data processing procedures with respect to processing performed on behalf of the controller. The contract shall be binding and clearly set forth: (a) instructions for processing data; (b) the nature and purpose of processing; (c) the type of data subject to processing; (d) the duration of processing; (e) the rights and obligations of both parties. (3) Confidentiality: contract shall require that the processor shall ensure that each person processing personal data is subject to a duty of confidentiality with respect to the personal data. (4) Subprocessor Approval: contract shall require that the processor shall engage any subcontractor only after providing the controller with an opportunity to object and shall require the subcontractor to meet the obligations of the processor with respect to the personal data through a written contract. (5) Audit Rights: contract shall require that the processor shall make available to the controller all information necessary to demonstrate the processor compliance with the obligations + and allow for + and contribute to + reasonable audits and inspections by the controller or the controller designated assessor + at the controller expense. (6) End of Contract: contract shall require that at the controller direction the processor shall delete or return all personal data to the controller as requested at the end of the provision of services unless retention of the personal data is required by law. (7) Assistance with Consumer Requests: processor shall assist controller in fulfilling consumer rights requests. (8) Determination Test: a person that is a processor with respect to one set of processing activities may be a controller with respect to a different set of processing activities + the determination of controller vs processor is fact-specific based on context. Coordinates with GDPR Art 28 + DPA template + similar state privacy laws + CCPA service provider/contractor agreement + FTC reasonable security + business contract law. ICDPA Processor Contracts applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.