Data processing agreement
No data processing agreement is created between the employer and AES, even if the employer sends personal data on employees to AES.
This is because the employer and AES each process personal data for their own purposes.
The employer is the data controller for the personal data on employees that it holds and forwards to AES. However, AES is also the data controller for the data that it receives from the employer. This is because AES is obliged to receive the information as part of its processing of cases involving industrial injuries.
A data processing agreement should not be created between two data controllers.
There should only be a data processing agreement if one of the parties acts as a data controller for the other party.
Nor should there be a data processing agreement between the employer and the Danish Working Environment Authority. The same rules as for AES are applicable here.