Regulation and data
Sub-processor
A sub-processor is another processor engaged by a processor to carry out part of the work on the controller's behalf, such as the company hosting the centre's management software in the cloud. It can only be brought in with the controller's prior written authorisation (art. 28.2 of the GDPR).
Also known assubprocessor · sub-contractor processor · subencargado
How it is authorised, and who answers for it
The GDPR does not use the word: it speaks of "another processor" (art. 28.2 and 28.4). If the centre takes on management software, that supplier is its processor (see controller and processor); if the software runs on a third party's servers, that third party is a sub-processor. The AEPD, the Spanish data protection authority, distinguishes two ways of authorising it:
| Specific authorisation | General authorisation | |
|---|---|---|
| What it authorises | A specific, identified entity | Subcontracting, without naming the entity |
| A change of sub-processor | Needs a new authorisation | The processor gives notice first and the centre may object (art. 28.2) |
| What is worth agreeing | The entity, its contact details and the processing it will do | The written form and the deadline for objecting, and a minimum notice period |
Worth knowing
The chain does not dilute responsibility. The processor has to impose on the sub-processor, by contract, the same obligations it has towards the centre, and if the sub-processor fails, the initial processor remains fully liable to the centre (art. 28.4). All of that goes into the DPA. If the sub-processor is outside the EEA, there is also an international transfer that needs its own safeguard. Asking for the list of sub-processors, with their role and location, is the quickest way to know where the centre's data travel.
Sources
Related terms
- Controller and processorThe controller is whoever decides what personal data are processed for and how; the processor is whoever processes them on the controller's behalf. In a residence, the centre is the controller of its residents' data, and the software supplier or the caterer that handles them for it is a processor.
- DPA (data processing agreement)A DPA (data processing agreement) is the contract that art. 28.3 of the GDPR requires between the controller and each processor: it sets out the subject matter, duration, nature and purpose of the processing, the type of data and of data subjects, and each party's obligations and rights.