Is It Appropriate to Conclude a Data Processing Agreement with an Entity Providing Data Migration Services?

ANSWER

If the migration involves personal data, then yes. A data processing agreement must be concluded when the controller commissions an external entity to process personal data on its behalf. The described situation — where a controller commissions an external entity to migrate data, including personal data, from one server to another — will involve the entrustment of personal data for processing. Processing of personal data, in accordance with Article 4(2) GDPR, encompasses not only the collection, modification, and storage of data, but also other operations performed on data, such as viewing, transmitting, and transferring it.

Accordingly, the activity under analysis falls within the concept of personal data processing, which means that a data processing agreement must be concluded with the external entity to which that activity has been commissioned.