GDPR and ISO 27701 for General Counsel: processor contracts, transfers and investigations

An EU customer wants us to sign a data processing agreement (DPA). What should the General Counsel look for?

• Article 28(3)(h): the processor makes available all information necessary to demonstrate compliance and allows for and contributes to audits, including inspections, by the controller or an auditor it mandates.
• EDPB Guidelines 07/2020: the agreement should not merely restate the GDPR but spell out how requirements will be met; engaging another processor must meet the conditions in Article 28(2) and (4); the processor assists the controller with its obligations under Articles 32 to 36.
• Article 33(2): the processor notifies the controller without undue delay after becoming aware of a personal data breach.

A review framework: how audits are done, how often and who pays; the sub-processor list and how changes are notified; whether breach notice is written as a fixed number of hours and whether the company can meet it; whether liability caps and indemnities match actual controls. Acceptable terms are for legal counsel to judge case by case.

We have no establishment in the EU. Does GDPR reach us? Do we need an EU representative? Which country's regulator handles incidents?

• Scope: a Taiwanese company with no EU establishment is covered only when it offers goods or services to people in the EU or monitors their behaviour in the EU (Article 3(2)).
• EU representative: where Article 3(2) applies, the controller or processor designates a representative in the Union in writing (Article 27(1), with exceptions).
• Regulator: with no EU establishment there is no one-stop shop, so a breach may need to be notified to supervisory authorities in several Member States.
• Roles: each business line may make you controller, joint controller or processor, with different obligations and contracts (Articles 24, 26 and 28).

Whether Article 3(2) applies and whether an Article 27 exception is available are legal judgements that ISO 27701 does not address; they are for legal counsel to judge case by case.

Data from EU subsidiaries or customers comes back to Taiwan. Which transfer documents does legal need?

1. Is it a transfer: EDPB Guidelines 05/2021 set three cumulative criteria: the exporter is subject to the GDPR for the processing, it discloses or makes data available to another party, and the importer is in a third country. Intra-group disclosures can be transfers; collecting data directly from people in the EU usually is not.
2. No adequacy decision for Taiwan: Taiwan is not on the European Commission's list of countries and territories recognised as adequate.
3. Article 46 safeguards: where it is a transfer, use standard contractual clauses (SCCs) or binding corporate rules (BCRs) plus a transfer impact assessment; CBPR certification is not an Article 46 transfer tool.
4. Article 49 derogations: exceptional by nature, not for routine, repeated transfers.
5. Taiwan side: under Article 21 of the Personal Data Protection Act, the central competent authority may restrict certain international transfers.

Which SCC module to use and whether BCRs are needed are for legal counsel to judge case by case.

If a personal data breach occurs, who decides on the 72-hour notification? Which records will stand up to an investigation?

• Deadline: under Article 33, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk.
• Records: under Article 33(5), the controller documents every personal data breach, including the facts, its effects and the remedial action taken, so the supervisory authority can verify compliance. A decision not to notify should be recorded too.
• Decide in advance: who decides whether to notify, who covers nights and holidays, and who approves the notification and what is said to data subjects.

The European Commission's Digital Omnibus proposal of 19 November 2025 would extend the deadline to 96 hours and raise the threshold; it is still in the legislative process, so 72 hours applies for now. Partial amendments to Taiwan's Personal Data Protection Act promulgated on 11 November 2025 take effect on a date set by the Executive Yuan; until then the current text applies.

A US court or another country's authority demands EU personal data from us. What do we do?

• Article 48: a third-country court judgment or administrative decision requiring a controller or processor to transfer or disclose personal data may only be recognised or enforced in the EU if based on an international agreement, such as a mutual legal assistance treaty, without prejudice to other grounds for transfer in Chapter V.
• EDPB Guidelines 02/2024 (version 2 adopted on 4 June 2025): a request from a foreign authority does not in itself constitute a legal basis for processing or a ground for transfer; apply a two-step test: a legal basis under Article 6, then compliance with Chapter V. Without an applicable international agreement, another Article 6 basis and another Chapter V ground are needed; Article 49 offers only a limited number of specific situations.

A framework: confirm where the request comes from and whether an international agreement applies, which entity holds the data, and whether it can go through mutual legal assistance in the EU subsidiary's country. How to respond when two legal systems conflict is for legal counsel to judge case by case.

What will a regulator look at in an investigation? How do we assess fines and representatives' liability? Does an ISO 27701 certificate help?

• Powers: the European Commission explains that supervisory authorities can order a company to provide any information they need, obtain access to premises and processing equipment, and impose a temporary or definitive ban on processing.
• Fines: up to EUR 20 million or 4% of total worldwide annual turnover, set by looking at the nature, gravity and duration of the infringement, whether it was intentional or negligent, action taken to mitigate harm to individuals, and the degree of cooperation.
• Compensation: an infringement of the GDPR alone does not give rise to compensation; individuals must prove actual damage.
• Taiwan: under Article 50 of the Personal Data Protection Act, when a non-government entity is fined, its representatives are fined the same amount unless they can show they fulfilled the duty to prevent.
• Limits of the certificate: an ISO 27701 certificate is not GDPR compliance; the Article 27 representative, the choice of SCC module and whether a DPIA is mandatory are legal judgements 27701 does not address.

Records of processing, DPIAs, contracts and breach records are what show cooperation and mitigation.

How does Winners Consulting help the General Counsel with GDPR and ISO 27701?

This is Winners Consulting's own account. Test us with the questions above.

• Who leads: VP- and director-level consultants run every engagement personally and do not outsource
• Scope and roles: we inventory data types, sources, purposes, retention and sharing, and determine GDPR scope and controller and processor roles
• Cross-border transfers: we review SCC contract clauses, assess transfer impact and keep complete cross-border transfer records
• 72-hour notification: we set up breach notification drills and an annual review
• One system: ISO 27701 as the framework, one system covering both GDPR and Taiwan's Personal Data Protection Act
• Division of work: we build the system and records; legal opinions come from partner lawyers
• Timeline (as listed on the service page): baseline GDPR compliance usually takes 2–3 months; integrated ISO 27701 certification 5–8 months
• Named clients: privacy clients who have authorised disclosure include the Joint Credit Information Center (JCIC), Lativ, 卓元科健 (Cho Yuan) and Hypercore Fitness Center

More: GDPR, ISO 27701, choosing a GDPR consultant, choosing an ISO 27701 consultant, CISO page