Sub-Processor Management

Sub-Processor Management

Overview

GDPR Article 28(2) establishes that a processor shall not engage another processor (sub-processor) without prior specific or general written authorisation of the controller. Where general authorisation is granted, the processor must inform the controller of any intended changes concerning the addition or replacement of sub-processors, giving the controller the opportunity to object. This creates an ongoing management obligation that extends through the entire processing chain.

The EDPB Guidelines 07/2020 (paragraph 93) emphasize that the controller's Article 28(1) due diligence obligation extends to oversight of sub-processor arrangements, and that the processor remains fully liable for the sub-processor's compliance.

At Summit Cloud Partners, the Sub-Processor Management Program ensures visibility and control over the entire processing chain for all vendor relationships involving personal data.

Authorization Models

Model A: Prior Specific Authorization

Under this model, the controller individually approves each sub-processor before engagement.

When to Use:

• High-risk processing (special category data, large-scale processing, cross-border transfers)
• Processing involving sensitive industries (healthcare, financial services)
• When the controller requires direct assessment of each sub-processor

Process:

Model B: General Written Authorization with Notification

Under this model, the controller grants blanket authorization for sub-processing, subject to a notification and objection mechanism.

When to Use:

• Standard-risk processing
• SaaS vendors with dynamic infrastructure providers
• When specific authorization would be operationally impractical

Process:

Notification Requirements

The EDPB has clarified that the notification mechanism must be genuine and effective — a mere listing on a website that the controller must monitor does not satisfy Article 28(2) without an active notification mechanism.

Required Notification Content:

Notification Channels:

• Email notification to designated controller privacy contact
• Supplement with web-based sub-processor register (not a replacement for active notification)
• Calendar integration for objection deadline tracking

Objection Mechanism

The controller's right to object must be genuine per EDPB Guidelines 07/2020 (paragraph 115). The DPA must specify:

1. Objection grounds: Reasonable data protection concerns (not arbitrary)
2. Objection period: Minimum 14 calendar days from notification receipt (Summit Cloud Partners standard: 30 days)
3. Objection format: Written notice to processor's designated privacy contact
4. Resolution process: Good-faith negotiation within defined timeframe
5. Escalation: If unresolved, termination right for affected services without penalty

Objection Decision Matrix:

Flow-Down Obligations

Article 28(4) requires the processor to impose on each sub-processor, by contract, the same data protection obligations as in the controller-processor DPA. The CJEU has not yet directly interpreted the meaning of "same" obligations, but the EDPB position is that they must be materially equivalent.

Flow-Down Checklist:

Key Consideration — Audit Rights Chain:

The controller must ultimately be able to audit the sub-processor. This can be achieved through:

1. Direct audit rights over sub-processor (contractually passed through)
2. Processor audits sub-processor on controller's behalf and shares results
3. Sub-processor provides independent third-party audit reports (SOC 2, ISO 27001)

Sub-Processor Register

Summit Cloud Partners maintains a centralized sub-processor register for all vendor relationships.

Register Fields:

Monitoring and Compliance

Ongoing Monitoring Activities

1. Quarterly sub-processor list reconciliation: Compare processor-provided lists against register
2. Certification tracking: Monitor sub-processor certification expiry dates
3. Change notification tracking: Verify all sub-processor changes were properly notified
4. Annual flow-down verification: Sample sub-processor DPAs to verify equivalent terms

Key Performance Indicators

Key Regulatory References

• GDPR Article 28(2) — Sub-processor authorization requirements
• GDPR Article 28(3)(d) — Sub-processor conditions in DPA
• GDPR Article 28(4) — Flow-down obligations to sub-processors
• EDPB Guidelines 07/2020 — Controller and processor concepts (paragraphs 93, 115)
• Commission Implementing Decision (EU) 2021/915 — SCC Clause 7.7 on sub-processing
• CJEU C-311/18 (Schrems II) — Transfer assessment obligations extending to sub-processor chain