(1) A controller shall engage a processor to carry out processing on its behalf only where -
(a) the processing is carried out, subject to subsection (3), in pursuance of a contract in writing between the controller and the processor that provides for the matters specified in subsection (2), and
(b) the processor provides sufficient guarantees to implement appropriate technical and organisational measures to ensure that -
(i) the processing shall comply with the provisions of this Part, and
(ii) the rights and freedoms of the data subjects are protected.
(2) A contract entered into between a controller and a processor in accordance with subsection(1)(a) shall -
(a) specify the subject matter, duration, nature and purpose of the processing to be carried out thereunder,
(b) specify the type of personal data to be processed thereunder and the categories of data subjects to whom the personal data relate,
(c) specify the obligations and rights of the controller in relation to the processing
…