නිල පරිවර්තනයවෙනස් නොකළ පාඨය, Department of Government Printing වෙතින්
(1)
Where processing is to be carried out by a processor on behalf of a controller, the controller shall–
(a)
use only processors who ensure the provision of appropriate technical and organizational measures to give effect to the provisions of this Act and ensure the protection of rights of the data subjects under this Act; and
(b)
ensure that such processor is bound by a contract or provisions of any written law which sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of the data subjects and the obligations of the controller.
(2)
Where two or more controllers jointly determine the purposes and means of processing, such controllers shall be referred to as “joint controllers” who shall be jointly responsible for discharging the obligations stipulated under this Act.