{
  "url": "https://openlegislation.uk/eu-decision-2020-655/article-7",
  "json_url": "https://openlegislation.uk/eu-decision-2020-655/article-7.json",
  "legislation": "eudn/2020/655",
  "legislation_title": "Decision (EU) 2020/655 of the European Central Bank of 5 May 2020 adopting implementing rules concerning data protection at the European Central Bank and repealing Decision ECB/2007/1 (ECB/2020/28)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2020-655",
  "path": "article/7",
  "kind": "article",
  "number": "7",
  "heading": "Tasks and duties of a controller",
  "text": "1. A controller shall ensure that all processing operations involving personal data that are performed within its area of responsibility comply with the provisions of Regulation (EU) 2018/1725 and any other Union data protection provisions applicable to the ECB.\n2. A controller shall ensure that the DPO is informed, without undue delay, of the following:\n(a) any issue that has, or might have, data protection implications;\n(b) any opinion, document, internal policy or internal decision that may impact on the ECB’s data protection compliance, before adoption;\n(c) any personal data breach or other incident concerning data protection;\n(d) any direct interaction of a controller with the EDPS.\n3. A controller, shall, in particular:\n(a) consult the DPO in a timely manner on any activities related to the processing of personal data or any other data protection issues;\n(b) conduct and approve data protection impact assessments in cooperation with the DPO and pursuant to Article 39 of Regulation (EU) 2018/1725;\n(c) comply with any relevant internal policies related to the processing of personal data or any other data protection issues;\n(d) maintain, in cooperation with the data protection coordinators, regularly updated records of processing activities in accordance with Article 31(5) of Regulation (EU) 2018/1725, using the template approved by the DPO.\n4. When assisting the DPO and the EDPS in performing their duties, a controller shall provide full information to them, grant access to personal data and respond to questions within 20 working days of receiving a request.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2020/655/article/7",
    "retrieved_at": "2026-11-01T15:12:16.265863+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}