# Sub-Processor Management — Register and Assessment Template

## Sub-Processor Register

**Controller:** Summit Cloud Partners
**Primary Processor:** [Processor Name]
**DPA Reference:** [DPA-XXXX]
**Register Last Updated:** [YYYY-MM-DD]
**Next Reconciliation Due:** [YYYY-MM-DD]

### Current Approved Sub-Processors

| # | Sub-Processor | Jurisdiction | Processing Location | Function | Data Access Scope | Transfer Mechanism | Certifications | Authorization Date | DPA Status |
|---|--------------|-------------|--------------------|-----------|--------------------|-------------------|----------------|-------------------|------------|
| 1 | [Name] | [Country] | [City, Country] | [Function] | [Data categories] | [N/A / SCC / DPF] | [Certs] | [Date] | [Executed/Pending] |
| 2 | [Name] | [Country] | [City, Country] | [Function] | [Data categories] | [N/A / SCC / DPF] | [Certs] | [Date] | [Executed/Pending] |

---

## Sub-Processor Change Notification Assessment

### Notification Details

| Field | Value |
|-------|-------|
| **Notification Date** | [YYYY-MM-DD] |
| **Processor** | [Processor Name] |
| **Change Type** | [Addition / Replacement / Removal] |
| **Objection Deadline** | [YYYY-MM-DD] |

### Proposed Sub-Processor

| Field | Value |
|-------|-------|
| **Legal Name** | [Full name] |
| **Jurisdiction** | [Country] |
| **Processing Location** | [City, Country] |
| **Function** | [What the sub-processor will do] |
| **Data Access Scope** | [Categories of personal data] |
| **Transfer Mechanism** | [If outside EEA] |
| **Certifications** | [Current certifications] |
| **Proposed Engagement Date** | [YYYY-MM-DD] |

### Risk Assessment

| Risk Factor | Present? | Score (0-4) | Notes |
|------------|----------|-------------|-------|
| Third-country jurisdiction | [Yes/No] | [Score] | [Details] |
| No adequate transfer mechanism | [Yes/No] | [Score] | [Details] |
| Missing security certifications | [Yes/No] | [Score] | [Details] |
| Access to sensitive data categories | [Yes/No] | [Score] | [Details] |
| Known breach history | [Yes/No] | [Score] | [Details] |
| **Total Risk Score** | | **[Total]** | |

**Risk Level:** [Low (0-2) / Medium (3-4) / High (5+)]

### Decision

| Field | Value |
|-------|-------|
| **Decision** | [No Objection / Conditional Approval / Objection] |
| **Decision Date** | [YYYY-MM-DD] |
| **Decision Maker** | [Name, Title] |
| **Grounds** | [If objecting or conditioning] |

**Conditions (if applicable):**
1. [Condition with deadline]
2. [Condition with deadline]

---

## Flow-Down Obligation Verification

**Sub-Processor:** [Name]
**Assessment Date:** [YYYY-MM-DD]
**Assessor:** [Name]

| Obligation | Article | Status | Notes |
|-----------|---------|--------|-------|
| Documented instructions | 28(3)(a) | [Compliant / Partial / Non-Compliant] | [Details] |
| Confidentiality | 28(3)(b) | [Compliant / Partial / Non-Compliant] | [Details] |
| Security measures (Art. 32) | 28(3)(c) | [Compliant / Partial / Non-Compliant] | [Details] |
| Further sub-processing | 28(3)(d) | [Compliant / Partial / Non-Compliant] | [Details] |
| DSR assistance | 28(3)(e) | [Compliant / Partial / Non-Compliant] | [Details] |
| Compliance assistance | 28(3)(f) | [Compliant / Partial / Non-Compliant] | [Details] |
| Deletion/return | 28(3)(g) | [Compliant / Partial / Non-Compliant] | [Details] |
| Audit rights | 28(3)(h) | [Compliant / Partial / Non-Compliant] | [Details] |
| Breach notification | 33(2) | [Compliant / Partial / Non-Compliant] | [Details] |

**Overall Assessment:** [Compliant / Partially Compliant / Non-Compliant]
**Remediation Required:** [Yes / No]
**Remediation Deadline:** [YYYY-MM-DD if applicable]

---

## Quarterly Reconciliation Report

**Quarter:** [Q1/Q2/Q3/Q4 YYYY]
**Processor:** [Processor Name]
**Reconciliation Date:** [YYYY-MM-DD]

| Sub-Processor | Register Status | Processor Report | Finding | Severity | Action |
|--------------|----------------|-----------------|---------|----------|--------|
| [Name] | [Active] | [Present] | [Match / Added / Removed / Changed] | [None/Med/High] | [Action] |

**Summary:**
- Total sub-processors in register: [N]
- Total in processor report: [N]
- Matches: [N]
- Discrepancies: [N]
- Actions required: [N]

**Assessor:** [Name, Date]
**Reviewed by:** [DPO/Privacy Lead, Date]