In its October plenary session on 8-9 October 2024, the European Data Protection Board (EDPB) adopted an Opinion on certain obligations following from the reliance on processor(s) and sub-processor(s).
The Opinion stresses the importance of controllers having readily available information on the identity of all processors and sub-processors to fulfil their obligations under Article 28 of the EU General Data Protection Regulation (GDPR). Furthermore, the Opinion highlights the controller’s responsibility to verify the sufficiency of guarantees provided by processors, irrespective of the risks to data subjects.
The Opinion also clarifies that the ultimate decision and responsibility for engaging a specific sub-processor lies with the controller. In addition, the Opinion states that controllers are not duty-bound to systematically request sub-processing contracts but should assess the necessity based on GDPR compliance.
Finally, in cases where transfers of personal data take place between processors outside the European Economic Area, the Opinion outlines the documentation requirements and clarifies that the controller is still subject to the duties stemming from Article 28(1) of the GDPR to ensure sufficient guarantees are in place alongside those under Article 44 and that it should assess the documentation and be able to show it to the relevant Data Protection Authority (DPA).
Tthe IAPP has provided a summary analysis of the EDPB Opinion.
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 5,750 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
