Controllers may use only Processors providing sufficient guarantees. Processing must be governed by a prescribed contract; sub-processing requires authorisation and equivalent obligations.
Interpretation and application must be checked against the official text and current version.