Should a data processing agreement be concluded with the administrator of the Public Information Bulletin (BIP) website?

ANSWER

Yes. A data processing agreement should be concluded with the entity on whose servers the BIP resources are hosted, and, where applicable, with other entities that provide software or maintain such a website. The volume of personal data entrusted for processing is irrelevant. Even if the website contains personal data relating only to the entity's director and the Data Protection Officer, such an agreement should still be concluded (names are personal data within the meaning of Article 4(1) GDPR). Under the GDPR, the requirement to conclude a processing agreement is not made conditional on the quantity of personal data entrusted to another external entity.