Module 3 · Sub-processors and Opinion 22/2024
A sub-processor is an entity engaged by a processor to help carry out the processing. EDPB Opinion 22/2024 makes three things clear: the controller must keep the identity of all processors and sub-processors readily available, the controller ultimately decides whether to engage a specific sub-processor, and Article 28(1) duties bite even on transfers between two sub-processors outside the EEA.
A sub-processor is another entity the processor brings in - for example, "Recruitment USA Inc." engaged by the recruitment agency. The chain of accountability still runs back to the controller.
- Controllers must have readily available the identity of all processors and sub-processors in the chain.
- The controller ultimately decides to engage a specific sub-processor, even where the initial processor vouches for sufficient guarantees.
- Controllers are subject to Article 28(1) duties when transfers occur between two sub-processors outside the EEA
The controller cannot delegate away its accountability. Even deep in the chain, it must know who every sub-processor is and it ultimately decides whether each one is used.