# Regulatory Standards — Sub-Processor Management

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 28(2)**: "The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes."

- **Article 28(3)(d)**: The DPA must require the processor to not engage a sub-processor without the conditions specified in Article 28(2) and (4).

- **Article 28(4)**: "Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations."

- **Article 82(2)**: "Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller." This establishes the liability framework for the processing chain.

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

- **Paragraph 93**: "The controller's obligation under Article 28(1) to use only processors providing sufficient guarantees extends to the sub-processing level. The processor must ensure that any sub-processor it engages also provides sufficient guarantees."

- **Paragraph 115**: "The objection mechanism must be genuine and effective. Merely providing a list of sub-processors on a website without active notification does not fulfil the requirement of Article 28(2) to give the controller the opportunity to object."

- **Paragraph 116**: "Where the controller does not object within a reasonable period, the general authorisation covers the new sub-processor. However, the controller retains the right to verify the sub-processor's compliance at any time."

### Commission Implementing Decision (EU) 2021/915 — Standard Contractual Clauses

- **Clause 7.7(a)**: The processor shall not sub-contract processing without the controller's prior specific or general written authorisation.
- **Clause 7.7(b)**: In the case of general written authorisation, the processor shall inform the controller of any intended changes to the list of sub-processors at least [specify time period] in advance.
- **Clause 7.7(c)**: The processor shall impose on the sub-processor, by contract, the same data protection obligations as imposed on the processor under these clauses.
- **Clause 7.7(d)**: The processor shall remain fully responsible to the controller for the performance of the sub-processor's obligations.

## Supervisory Authority Guidance and Enforcement

### Berlin DPA — Sub-Processor Notification Enforcement (2023)

The Berliner Beauftragte fur Datenschutz found a controller non-compliant for failing to exercise meaningful oversight over sub-processor changes. The processor had added three sub-processors without notification, and the controller's DPA lacked an adequate objection mechanism.

### Austrian DPA (DSB) — Sub-Processor Flow-Down Decision (2022)

The Austrian DPA held that a processor's sub-processor agreement that contained weaker data protection terms than the controller-processor DPA violated Article 28(4). The sub-processor DPA had a 72-hour breach notification period while the main DPA required 24 hours — the DSB found this inconsistent.

### CNIL — Sub-Processor Transparency Guidance (2022)

CNIL published guidance requiring that:
- Controllers be informed of the complete sub-processor chain (not just direct sub-processors)
- Each level of the chain must have equivalent contractual protections
- The controller's audit right must extend through the chain (directly or through cascade)

### ICO (UK) — Processor and Sub-Processor Guidance

The ICO emphasizes:
- General authorization is the default where specific authorization would be impractical
- Notification must be active (push notification), not passive (requiring controller to monitor)
- The objection mechanism must include a genuine ability to refuse without penalty
- Controllers must maintain records of all sub-processors in the processing chain