Despite the long time that has passed since the entry into force of the GDPR (General Data Protection Regulation), its application still raises many questions in practice. Controllers - and there are many of them - are considering many aspects of implementing the protection. However, there also seem to be areas that do not raise any doubts, although they should be a field of factual analysis of a specific case and the subject of appropriate (not mechanical) application of the regulation.
It is about concluding agreements of entrustment of data processing, which are an obligatory element of the relationship between the controller and the processor, in which one party processes data "on behalf of" and "on the order" of the other. This agreement has been described in article 28 of the GDPR and may take a written or documentary form (or rather a text form - not every document within the meaning of the Polish Civil Code would meet the requirements of the EU Regulation) - therefore, conclusion of an oral agreement is excluded.
In practice, such agreements often boil down to repeating the provisions of the Regulation, although their conclusion is not always justified. However, such preventive contractual relationships neither guarantee data security nor fulfil the legal requirements.
Above all, it is not always the case that there is a transfer or disclosure of data to another entity and simultaneously entrustment of the data. It is not necessary that there is always one party to act as a processor - nothing prevents that data are processed in parallel by two or more controllers. In fact, the same data are often processed by many entities, each acting in its own interest and not subject to the instructions of the other.
However, if processing on the basis of entrustment actually takes place, it is also important what role the parties - controller or processor - have, and it is the legislation that determines the role of the different entities in the processing. The parties cannot decide on their own on whose behalf and for whose order personal data will be processed - the actual situation is decisive here, not the will of those involved, who cannot change the direction of the relationship. However, in practice, contracts are often concluded without a thorough analysis of the actual relationship, and the relationship set out in them does not comply with the regulations. A good example of this can be agencies looking for job candidates that meet the criteria of employers - such agencies are sometimes processors and sometimes controllers.
Conclusion of agreements concerning entrusting data processing 'just in case' or on the basis of an incorrectly drawn up draft or template may have unfavourable consequences, since the processing identified in this way preclude the correct filling in of the GDPR documentation, which is the implementation of the principle of legality and accountability of processing the data.