All Articles

ENGAGING A SUB-PROCESSOR: INFORMATION AND AUTHORISATION REQUIREMENTS

Article 28(2) and (4) of the GDPR directly deal with the situation where a processor engages “another processor,” which can be called a “sub-processor” or a “level 2 processor”.

Under the GDPR, the controller must give its prior written authorisation when its processor intends to entrust all or part of the tasks assigned to it to a sub-processor.

Even after having obtained the controller’s formal authorisation, the processor remains fully liable to the controller for the performance of the sub-processor’s obligations. In case of cascading subcontracting, these obligations will be passed down to the other sub-processors (level 3 processor and so on).

CLAUSES YOU NEED TO INCLUDE IN THE CONTRACT BETWEEN A PROCESSOR AND A SUB-PROCESSOR

The contract between a processor and a sub-processor must at least contain the same data protection obligations as set out in the contract between the processor and the controller. In practice, this contractual scheme is often referred to as a “back to back contract”. 

The contract to be entered into between the processor and its sub-processor must therefore necessarily contain the provisions stipulated in Article 28(3) of the GDPR, namely:

• the subject-matter and duration of the processing of personal data;
• the nature and purpose of the processing; 
• the obligations of security, warning and alert towards the controller. 

For any cloud contract (IaaS, PaaS, SaaS), the above-mentioned obligations of the GDPR regarding sub-processors may require the following:

• a clause “Representations” containing representations from the processor to the sub-processor regarding all relevant information on the purpose of the processing of personal data made as decided by the controller and to be carried out using the means made available by the sub-processor;
• a clause “Instructions” describing the instructions given from the processor to the sub-processor and how the latter must apply them;
• a clause “Security” presenting the physical and logical security policy deployed by the sub-processor, in addition to the measures applicable in case of unauthorised intrusion (data breach process); this clause should be associated with an appendix dedicated to a security assurance plan;
• a clause under which the processor and sub-processor agree to cooperate in the event a data subject wants to exercise his or her rights;
• a clause “Confidentiality”, which should guarantee confidentiality not only from the sub-processor’s own employees, but also from any subcontractors or freelancers hired by the sub-processor to assist in the performance of its obligations;
• clauses on the sub-processor’s obligation to inform (in general, and not only in the event of data breach) and the conditions for conducting audits in accordance with Article 28(3)(h) of the GDPR;
• the conclusion of standard contractual clauses (2) if the data are transferred outside the European Union to a country not considered as ensuring an adequate level of protection (if data are transferred to the United States, a specific framework may apply: the EU-U.S. Privacy Shield (3);
• clarifications on the termination of contractual relationships and the destruction of data in the cloud. 

If yet another processor is engaged, the contract to be concluded between the level 2 processor and the level 3 processor must also reflect these requirements.