How does UU 27/2022 govern personal data processors in healthcare?

Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) defines a personal data processor as a party that processes personal data on behalf of. Furthermore, Under the instructions of a data controller, rather than for its own purposes. Processors carry direct statutory duties, including implementing technical security controls and obtaining written consent before engaging sub-processors. Lawful processing conducted within instructions remains the controller's responsibility, while actions outside instructions trigger independent processor liability.

Who is a processor and how does it differ from a controller

A personal data controller determines the purposes and exercises control over data processing (Article 1 point 4). A personal data processor carries out processing on behalf of the controller (Article 1 point 5). Both may be individuals, corporations, public bodies, or international organizations (Article 1 point 7 and Article 19).

In healthcare operations, a clinic or hospital that collects patient data acts as a controller. A healthcare IT vendor, cloud hosting provider, or AI software vendor that processes that data under facility instructions acts as a processor. Patient health data is classified as specific personal data (Article 4 paragraph (2)(a)).

Five core obligations of personal data processors

• Processing within instructions (Article 51 paragraphs (1) and (2)): Processors must process personal data solely on controller instructions and in compliance with UU 27/2022.
• Written consent for sub-processors (Article 51 paragraphs (4) and (5)): Processors must obtain prior written approval from the controller before engaging third-party sub-processors.
• Parallel security obligations (Article 52). Processors must maintain data accuracy (Article 29), record processing logs (Article 31), secure electronic systems (Article 35), preserve confidentiality (Article 36). In addition, Prevent unauthorized access (Article 39).
• DPO appointment (Article 53 paragraph (1)): Appoint a Data Protection Officer when processing large-scale specific data or conducting regular, systematic monitoring.
• Compliance with authority orders (Article 49): Obey lawful orders issued by the personal data protection authority.

Allocation of legal responsibility and administrative sanctions

• Processing liability (Article 51 paragraphs (3) and (6)): Processing performed under controller instructions remains the legal responsibility of the controller (Article 47). However, if the processor processes data beyond controller instructions and purposes, the processor assumes independent legal liability.
• Breach notification (Article 46): The statutory 3 x 24-hour breach notification duty is placed directly on the controller. Making it essential for service contracts to require processors to report breaches immediately to the controller.
• Administrative sanctions (Articles 57 and 60): The PDP authority may impose administrative sanctions directly on processors. This includes Written warnings, temporary suspension, data destruction, and/or fines of up to 2 percent of annual revenue against the violation variable.
• Cross-border data transfers (Article 56): When using an overseas processor, the controller must ensure the processor's jurisdiction provides equivalent protection or execute binding contractual clauses.

Legal basis

• Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 1 points 4, 5, 7. Article 4 paragraph (2)(a). Article 19. Article 37. Article 46. Article 47. Article 49. Articles 51–53. Article 56. Article 57. Article 60. and Article 74.
• Draft Government Regulation Implementing UU 27/2022 (public consultation draft dated 31 August 2023, Article 21, not yet in force).