Commentaries: Art. 5

The private controller and its private processor must issue regulations on automated processing if they:
1. process a large volume of sensitive personal data; or
2. carry out high-risk profiling.
The regulations must in particular include details of the internal organisational structure, data processing and control procedures and the measures that guarantee data security.
The private controller and its private processor must update the regulations regularly. If a data protection officer has been appointed, the regulations must be made available to the officer.