Is it necessary to conclude a data processing agreement with a company providing ISO conformity certification audit services?

ANSWER

It is not appropriate to conclude a data processing agreement with a company conducting audits, because the data controller should not issue any binding instructions or orders to that company. In such a case the audit conducted would not be credible.