sub-processor
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
sub-processor - A processor engaged by the processor; must be subject to the same contractual obligations and the controller must at minimum get notice and a right to object.
In the CIPP/E body of knowledge, sub-processor comes up under Ch 17.2.3 - Processor contracts; Ch 18.2.3-18.2.5 - When a supplier crosses the line; Ch 4.4.9-4.4.10 - Processor and processing contracts.
sub-processor in context
- [[Article 28]] requires a ==written contract== with mandatory terms: process ==only on documented instructions==, confidentiality, Article 32 security, sub-processor conditions, assist with data subject rights and Articles 32-36, ==delete or return== data at the end, and allow ==audits==. (The Processor and the Article 28 Contract)
- Where outsourcing forms a chain, [[Articles 28(2) and (4)]] set conditions on engaging a [[sub-processor]]. (Subcontracting conditions)
- A [[sub-processor]] is an entity engaged by a processor to help carry out the processing. (Module 3 · Sub-processors and Opinion 22/2024)
Where sub-processor is covered in the CIPP/E study notes
- The Processor and the Article 28 Contract
- Cloud service contracts (Article 28)
- Suppliers as controllers, AI, and chains of processors
- Module 3 · Sub-processors and Opinion 22/2024
Related terms
- Article 28
- Article 29
- Article 28 contract
- EU Cloud Code
- Article 28(10)
- CNIL Guide for Processors
- Essential means
- EDPB Opinion 22/2024
Test yourself on sub-processor
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.