External parties and transfers

Authorise and govern a subprocessor

Record general or specific authorisation, provide notice of proposed changes, and verify that equivalent obligations are imposed further down the chain.

A processor's own hosting provider is a subprocessor, and the chain from controller to that subprocessor has to be visible in one place, not scattered across two separate contracts held by two separate teams.

This is exercised when a processor notifies its client of a new subprocessor: the authorisation type is recorded, the notice period is checked, and the back to back obligations are confirmed before the change proceeds.

The proof is that a subprocessor with no authorisation is caught as a gap, and that the full chain can be read from a single screen.

Regulation

Articles 28(2) and 28(4)

Registers

Entity · Agreement · Processing activity · Transfer record

The steps

1. 01Open the Entities register and use the plus button beside the register title to create the subprocessor entity.
2. 02Open the Linked records band and use "Link a record" to attach it to its processor.
3. 03On the Details tab, record the authorisation type, general or specific, and the notice period agreed.
4. 04Use "Link a record" to attach the agreement holding the back to back terms.
5. 05Move the subprocessor entity from Draft to Approved on the lifecycle bar.