Processor/Controller

2. I should also appreciate if you could have the contents of my two agreement drafts checked for correctness and completeness.

Answers:

1. A processor sould always process personal data on behalf of a controller based on a commercial agreement so your assumption is correct the processor is usually a supplier.
2. As regards to the review of your documents, based on the version of the Toolkit you purchased you are entitled to one document (from the toolkit) to be reviewed.

To learn more about the EU GDPR check out our “EU GDPR Foundation Course” (https://advisera.com/training/eu-gdpr-foundations-course//)

So why do we need two separate data processing agreements - one for data transfers and one for third party compliance?

You only need two documents if the third party acting as your processor is located outside the EEA. In this case you need to consider both the requirements of article 28 of the EU GDRPR – “Processors “ https://advisera.com/eugdpracademy/gdpr/processor/ as well as the requirements for cross border data transfers set up in article 46.2.c) of the EU GDPR – “Transfers subject to appropriate safeguards” https://advisera.com/gdpr/transfers-subject-to-appropriate-safeguards/

Thank you!