Should a processor be verified before the start of a service, during its performance, and after its completion, e.g. by obtaining a declaration confirming the deletion of data upon termination of the contract?

ANSWER

A processor should be verified before signing the data processing agreement and also periodically during the term of the agreement. The processing agreement should include an explicit obligation on the processor to delete the data upon termination of the contract and should provide for the possibility of verifying this process. Failure to delete the data would constitute a breach of contract. Obtaining an additional declaration from the processor confirming the deletion of data upon termination of the contract is not required, but it is possible.