Should an employer sign a processor agreement with an occupational healthcare provider?

ANSWER

Between the employer and the occupational healthcare provider, no personal data processing agreement under Article 28(3) GDPR is concluded. In this respect, that entity — an organizational unit of the occupational medicine service — is an independent personal data controller pursuing its own purposes of processing personal data. The sharing (not entrustment) of employee data should be regulated by the parties in the main contract concluded between the employer and that entity.