Under Article 28(3)(b) the contract must say that the processor must obtain a commitment of confidentiality from anyone it allows to process the personal data, unless that person is already under such a duty by statute.
This contract term should cover the processor’s employees as well as any temporary workers and agency workers who have access to the personal data.
