When an employee employed at a municipal office enters into a contract of mandate with the municipality for performing duties as an IT operator supporting a District Electoral Commission, is there an obligation to sign a data processing agreement?

ANSWER

If a person employed by the data controller (here: the municipal office) is an employee of the controller employed under an employment contract, a contract of mandate or a contract for specific work (as it is not always only an employment contract), as a rule that person should be granted authorisation to process personal data on behalf of the controller.

If, however, that person constitutes an independent entity, i.e. runs their own business activity, a data processing agreement must be concluded.

In the case of engagement of a natural person on the basis of a contract of mandate, it will therefore be appropriate to grant them authorisation to process personal data, especially if they will perform their duties using the controller's infrastructure.