The Data Fiduciary stays responsible for processing carried out on its behalf, and may engage a Processor only under a valid contract. This register tracks whether that contract actually says what the Rules require.
7 agreements lack the security provisions prescribed by Rule 6(1)(f)
Processing continues under these contracts. The department remains liable without any contractual means of enforcing safeguards or requiring timely breach notification.