Can special category personal data be entrusted for processing?

ANSWER

The data controller may entrust personal data to another external entity for processing on its behalf. In this respect, a data processing agreement must be concluded. The GDPR does not limit entrustment of processing to ordinary personal data only. Special category personal data may also be entrusted for processing. The rules will be the same for both types of data (ordinary and sensitive). A data processing agreement must be concluded specifying what type of personal data is entrusted for processing. As regards the rules, it is recommended to read our article. It explains in detail how the data controller may audit the processor, which is particularly important when both ordinary personal data and special category data are subject to entrustment.