Weitergabe personenbezogener Daten an Dritte: Die 7 Risiken der DSGVO, die es zu bewältigen gilt

You may only share personal data under the GDPR if you have a legal basis under Article 6, have settled in writing whether the recipient is a processor or a controller, and have told the people concerned about the sharing. The main exceptions are transfers outside the European Economic Area (EEA) and high-risk processing, which bring extra requirements under Chapter V and Article 35 GDPR.

In den Niederlanden ist die niederländische Datenschutzbehörde (Persönliche Daten der BehördeAP) setzt die DSGVO zusammen mit dem niederländischen Durchführungsgesetz durch (DSGVO-Umsetzungsgesetz, UAVG). Every flow to a cloud provider, payroll bureau, debt collector or group company abroad is a separate processing operation that needs its own justification. Below we set out seven risks that recur in practice, the provisions behind them and what you can do about each.

Risiko 1: Geben Sie Daten ohne gültige Rechtsgrundlage weiter?

Jede Offenlegung personenbezogener Daten bedarf einer der sechs Rechtsgrundlagen gemäß Artikel 6 Absatz 1 DSGVO. Ein kommerzieller Grund zählt nicht dazu.

The six bases are exhaustive: consent, performance of a contract, a legal obligation, vital interests, a public task and legitimate interests. Article 5(1)(a) adds that processing must be lawful, fair and transparent, so a basis that was never explained to anyone still leaves a gap.

Warum ist berechtigtes Interesse eine Falle?

Legitimate interests is the basis most often used for sharing with partners, and most often used incorrectly. It requires a three-step test:

• Das Interesse muss berechtigt sein;
• Das Teilen muss notwendig sein, damit es dienen kann;
• Das Interesse darf nicht durch die Rechte und Freiheiten der betroffenen Personen eingeschränkt werden.

You must carry out and record this test before the sharing starts, because Article 5(2) GDPR puts the burden of proof on the controller (accountability). An assessment written after a complaint arrives is worth very little.

Wie sieht es mit Einwilligung und Zweckbindung aus?

Consent from employees is rarely valid, because the imbalance of power means it is not freely given (Article 7(4) and recital 43 GDPR). Purpose limitation under Article 5(1)(b) also applies to sharing: data collected to deliver a service cannot simply go to a partner for marketing. Where the new purpose is not compatible with the original one, you need a fresh basis.

Was ist zu tun: identify the basis before data leaves your organisation, write it down and check that your privacy notice already describes the sharing. Consent must be freely given, specific, informed, unambiguous and as easy to withdraw as to give (Articles 4(11) and 7(3) GDPR).

Risiko 2: Sind die Rollen von Controller und Prozessor vertauscht?

Der Verantwortliche legt die Zwecke und Mittel der Verarbeitung fest; ein Auftragsverarbeiter handelt ausschließlich nach den dokumentierten Weisungen des Verantwortlichen (Art. 4 Abs. 7 und 8 DSGVO). Entscheidend ist, wer die Entscheidung tatsächlich trifft, nicht die vertraglich festgelegte Bezeichnung der Parteien.

The common error is to label every supplier a processor. Yet none of the following acts purely on instructions:

• ein SaaS-Anbieter, der Kundendaten nutzt, um sein eigenes Produkt zu verbessern;
• ein Buchhalter, der an Berufsregeln gebunden ist;
• eine Bank, die eine Zahlung ausführt;
• Eine Werbeplattform, die ihre eigenen Zielgruppenprofile erstellt.

Each is a controller for at least part of the processing. Where two organisations jointly determine purposes and means, they are joint controllers under Article 26 GDPR. They must set out their responsibilities in an arrangement and make its essence available to the people concerned.

Wie weit gefasst definiert der Gerichtshof der Europäischen Union den Begriff der gemeinsamen Kontrolle?

Im Großen und Ganzen. In Fashion ID (C-40/17), the Court of Justice held that a website operator embedding a third-party social plug-in was a joint controller for the collection and transmission of visitors’ data, even though it had no access to the data afterwards. Partial influence over the purposes is enough, and the result is joint liability for a breach you did not cause.

Was ist zu tun: map the data flows and record, for each flow, who decides why and how the data is processed. Use a processing agreement under Article 28 for processors and a joint controller arrangement under Article 26 where both parties decide.

Risiko 3: Fehlt Ihre Datenverarbeitungsvereinbarung oder ist sie fehlerhaft?

If a processor handles personal data for you, Article 28(3) GDPR requires a written contract. Without it, you are in breach from the moment processing begins, even if no data ever leaks.

The content is prescribed by law. A compliant Datenverarbeitungsvertrag states the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of people, and the controller’s rights and obligations. It must also bind the processor to:

• Arbeiten Sie ausschließlich nach dokumentierten Anweisungen;
• seinen Mitarbeitern Vertraulichkeit auferlegen;
• die in Artikel 32 geforderten Sicherheitsmaßnahmen ergreifen;
• help with data subject requests and breach notification;
• Die Daten nach Beendigung des Auftrags löschen oder zurückgeben;
• provide the information needed to demonstrate compliance, and allow audits.

Warum schlagen Unterprozessorklauseln so oft fehl?

Under Article 28(2) and (4), the processor needs your prior specific or general written authorisation for any sub-processor. With a general authorisation, it must inform you of intended changes and give you the chance to object; a clause letting it engage anyone it likes does not meet that standard.

Was ist zu tun: work from a template that follows Article 28(3) clause by clause and review existing agreements rather than relying on a supplier’s own terms. Long-standing relationships are the most likely to be undocumented.

Risiko 4: Übertragen Sie Daten ohne Schutzmaßnahmen außerhalb des EWR?

A transfer outside the EEA is only allowed on the basis of an adequacy decision (Article 45 GDPR) or appropriate safeguards (Article 46), usually the Commission’s standard contractual clauses (SCCs) or binding corporate rules. The derogations in Article 49, such as explicit consent, are for occasional transfers and cannot support a structural data flow.

A transfer takes place whenever data becomes accessible from outside the EEA, not only when it is copied there. Remote administration by a parent company abroad is a transfer, even if the servers stay in Frankfurt.

Was bedeuten das Schrems-II-Verfahren und der Data Privacy Framework für Sie?

In Schrems II (C-311/18), the Court of Justice invalidated the EU-US Privacy Shield and held that standard contractual clauses are not enough on their own. The exporter must assess whether the law of the destination country undermines the clauses and add supplementary measures where it does; that transfer impact assessment (TIA) is still required for every Article 46 transfer.

The Commission adopted an adequacy decision for the EU-US Data Privacy Framework (DPF) in July 2023, and on 3 September 2025 the General Court dismissed an action for its annulment (Latombe, T-553/23). Transfers to a US organisation certified under the framework, for the data its certification covers, can rely on adequacy; transfers to other US recipients cannot. An appeal to the Court of Justice is possible, so check the certification and keep a fallback in place.

Was ist zu tun: list the third-country transfers in your supply chain, including sub-processors and support arrangements. Where adequacy does not apply, use the current SCCs, document a TIA and record supplementary measures such as encryption with keys held in the EEA. The AP can order a transfer to be suspended under Article 58(2)(j) GDPR.

Risiko 5: Verzichten Sie auf eine Datenschutz-Folgenabschätzung?

Artikel 35 DSGVO schreibt eine Datenschutz-Folgenabschätzung (DSFA) vor, wenn die Verarbeitung voraussichtlich ein hohes Risiko für Einzelpersonen birgt. Die Weitergabe von Daten überschreitet diese Schwelle oft schneller als von Organisationen erwartet.

Article 35(3) names three cases: systematic and extensive automated evaluation with legal or similarly significant effects, large-scale processing of special categories or criminal data, and large-scale systematic monitoring of a public area. The AP also publishes a list of operations for which a DPIA is always required. Combining datasets, sharing health data with an analytics provider or monitoring employees will often cross the threshold on its own.

Was muss eine Datenschutz-Folgenabschätzung enthalten?

Under Article 35(7), a DPIA describes the processing and its purposes, assesses necessity and proportionality, identifies the risks to the people concerned and sets out the measures that address them. Where a high residual risk remains, Article 36 requires prior consultation of the AP before the processing starts.

Was ist zu tun: screen every new data-sharing arrangement against Article 35(3) and the AP list, and involve your data protection officer if you have one. Revisit the DPIA when the processing changes; failing to carry out a required DPIA is an infringement in itself.

Risiko 6: Informieren Sie die Menschen zu wenig über das Teilen?

Transparency is a separate obligation, which you can breach even where the sharing itself is lawful. Articles 13 and 14 GDPR require you to state the purposes, the legal basis and the recipients or categories of recipients.

A sentence saying that data “may be shared with trusted partners” identifies nothing. Name the categories concretely, such as hosting providers, payroll administrators or credit reference agencies. For transfers outside the EEA, Articles 13(1)(f) and 14(1)(f) require the notice to say so and to identify the safeguard relied on.

Welche zusätzlichen Kosten fallen an, wenn Sie die Daten nicht selbst erhoben haben?

Under Article 14, the notice must also state the categories of data and their source. You must provide it within a reasonable period and at the latest within one month, or at the first communication with the person if that comes sooner. Our page on a Datenschutzbestimmungen in den Niederlanden sets out the full content.

Was ist zu tun: update the notice before a new recipient receives data, not at the next annual review. Article 12(1) requires notices to be concise, intelligible and in clear and plain language.

Risiko 7: Behandeln Sie pseudonymisierte Daten als anonym?

For the organisation that holds the key, pseudonymised data remains personal data. Only true anonymisation takes data outside the GDPR.

Article 4(5) GDPR defines pseudonymisation as processing data so that it can no longer be linked to a person without additional information that is kept separately. Recital 26 confirms that such data stays within the GDPR for whoever can re-identify it. Replacing names with customer numbers therefore does not remove the need for a legal basis, a processing agreement or a privacy notice on your side.

Can pseudonymised data be non-personal for the recipient?

Possibly. In EDPS v SRB (C-413/23 P, 4 September 2025), the Court of Justice held that pseudonymised data need not be personal data for a recipient who cannot reasonably re-identify the people concerned. The court also held that the disclosing controller must still inform those people about the recipient at the time of collection.

Was ist zu tun: assess the means reasonably likely to be used by the recipient, including other datasets it holds; a postcode, date of birth and transaction history often allow re-identification. Document how the key is kept separate. Article 32 names pseudonymisation as a security measure, which counts in your favour if a breach is assessed.

Wie sieht die Durchsetzung der Gesetze in den Niederlanden aus?

Under Article 58 GDPR, the AP can warn, reprimand, order compliance, ban processing and suspend transfers, and Article 83 allows fines. For a business that depends on a particular data flow, a ban is often more damaging than the fine.

Article 83 has two tiers, each with a fixed maximum or a percentage of worldwide annual turnover in the previous financial year, whichever is higher:

• Untere Stufe: up to EUR 10 million or 2%, for example for a missing processing agreement or DPIA (Articles 25 to 39).
• Höhere Stufe: up to EUR 20 million or 4%, for breaches of the principles, the legal bases, data subject rights and the transfer rules.

Article 82 GDPR gives anyone who suffers material or non-material damage a right to compensation from the controller or processor. In the Netherlands, foundations increasingly bring such claims collectively under the Act on the settlement of mass damages in collective actions (Nasse Gesichtsmassage in kollektiven Aktivitäten, WAMCA, Article 3:305a BW).

If unlawful sharing leads to a data breach, Article 33 requires notification to the AP without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk. Under Article 34 you must also inform the people affected if the risk to them is high. Document every breach internally, including those you do not notify.

What should you check as the organisation sharing the data?

As controller, you carry the main responsibility and must be able to prove compliance under Article 5(2) GDPR. Check these points before data leaves your organisation:

• The legal basis under Article 6 is identified and, for legitimate interests, the balancing test is on file.
• The recipient’s role is recorded in your record of processing activities under Article 30.
• A processing agreement under Article 28 or an arrangement under Article 26 is signed.
• Any transfer outside the EEA rests on adequacy or SCCs plus a TIA.
• A DPIA screening has been done and documented.
• Your privacy notice names the recipient or its category.

What should you check as the recipient of the data?

As a processor or receiving controller, you have your own obligations and can be fined directly under Article 83 GDPR. Check these points before you accept the data:

• Whether you act only on instructions (processor) or also use the data for your own purposes (controller).
• Whether the instructions in the processing agreement match what you actually do with the data.
• Whether your sub-processors are authorised in writing under Article 28(2).
• Whether your security measures meet Article 32 and you can notify breaches to the controller without undue delay (Article 33(2)).
• Whether you keep your own record of processing under Article 30(2).

What can we do for you with GDPR data sharing?

Unsere IT-Recht team handles the data protection side of supplier, group and partner arrangements. Concretely:

• We map your data flows and determine for each recipient whether it is a processor, joint controller or independent controller.
• We draft or review processing agreements under Article 28 and joint controller arrangements under Article 26.
• We assess transfers outside the EEA, check DPF certifications and draft the transfer impact assessment.
• We carry out or review the DPIA screening and the DPIA itself.
• We update your privacy notice so that recipients and transfers are named correctly.
• We assist you in an AP investigation or with a breach notification within the 72-hour deadline.

Zusammenfassung

• Jede Weitergabe personenbezogener Daten bedarf einer Rechtsgrundlage gemäß Artikel 6 DSGVO; ein kommerzieller Grund genügt nicht.
• Determine for each recipient whether it is a processor, a joint controller or an independent controller, and document it.
• Für Auftragsverarbeiter ist eine Verarbeitungsvereinbarung gemäß Artikel 28 zwingend erforderlich; ohne eine solche Vereinbarung verstoßen Sie vom ersten Tag an gegen die Vereinbarung.
• Für Transfers außerhalb des EWR ist ein angemessenes Sicherheitsniveau (z. B. eine DPF-Zertifizierung) oder eine Schutzmaßnahme sowie eine Folgenabschätzung erforderlich.
• Pseudonymised data stays personal data for whoever holds the key, and your privacy notice must name the recipients concretely.

Häufig gestellte Fragen