GDPR: Rights and Obligations of Sub-Processors

Technical architectures in the cloud are complex and regularly involve several layers of data processors. When personal data is processed in the cloud, the GDPR (1) requires a high degree of transparency.

Engaging a sub-processor: information and authorisation requirements

Article 28(2) and (4) of the GDPR directly deal with the situation where a processor engages “another processor,” which can be called a “sub-processor” or a “level 2 processor”.

Under the GDPR, the controller must give its prior written authorisation when its processor intends to entrust all or part of the tasks assigned to it to a sub-processor.

Even after having obtained the controller’s formal authorisation, the processor remains fully liable to the controller for the performance of the sub-processor’s obligations. In case of cascading subcontracting, these obligations will be passed down to the other sub-processors (level 3 processor and so on).

Clauses you need to include in the contract between a processor and a sub-processor

The contract between a processor and a sub-processor must at least contain the same data protection obligations as set out in the contract between the processor and the controller. In practice, this contractual scheme is often referred to as a “back to back contract”. 

The contract to be entered into between the processor and its sub-processor must therefore necessarily contain the provisions stipulated in Article 28(3) of the GDPR, namely:

• the subject-matter and duration of the processing of personal data;
• the nature and purpose of the processing; 
• the obligations of security, warning and alert towards the controller. 

For any cloud contract (IaaS, PaaS, SaaS), the above-mentioned obligations of the GDPR regarding sub-processors may require the following:

• a clause “Representations” containing representations from the processor to the sub-processor regarding all relevant information on the purpose of the processing of personal data made as decided by the controller and to be carried out using the means made available by the sub-processor;
• a clause “Instructions” describing the instructions given from the processor to the sub-processor and how the latter must apply them;
• a clause “Security” presenting the physical and logical security policy deployed by the sub-processor, in addition to the measures applicable in case of unauthorised intrusion (data breach process); this clause should be associated with an appendix dedicated to a security assurance plan;
• a clause under which the processor and sub-processor agree to cooperate in the event a data subject wants to exercise his or her rights;
• a clause “Confidentiality”, which should guarantee confidentiality not only from the sub-processor’s own employees, but also from any subcontractors or freelancers hired by the sub-processor to assist in the performance of its obligations;
• clauses on the sub-processor’s obligation to inform (in general, and not only in the event of data breach) and the conditions for conducting audits in accordance with Article 28(3)(h) of the GDPR;
• the conclusion of standard contractual clauses (2) if the data are transferred outside the European Union to a country not considered as ensuring an adequate level of protection (if data are transferred to the United States, a specific framework may apply: the EU-U.S. Privacy Shield (3);
• clarifications on the termination of contractual relationships and the destruction of data in the cloud. 

If yet another processor is engaged, the contract to be concluded between the level 2 processor and the level 3 processor must also reflect these requirements.

Streamlining the contract process with sub-processors

In order to ensure that the sub-processor contract remains legible, it is possible to include the GDPR obligations listed above in a dedicated appendix.

But in reality, the only effective way to simplify the contract is to get a certification.

Both processors and sub-processors can be certified. Without prejudice to the provisions of their contract, Article 28 of the GDPR allows them to adhere to a code of conduct (Article 40) or a certification mechanism (Article 42), which may be used as an element by which to demonstrate they provide the sufficient guarantees required from all processors, regardless of their level (Article 28(5)). This means that the clauses of their contract need not be as detailed as explained above, at least as long as the certification of the processor and the sub-processor is valid.

References

1. Regulation 2016/679 of 27-4-2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation (“GDPR”).
2. C. Avignon, « La décision d’adéquation pour l’EU-US Privacy Shield », alain-bensoussan.com, 13-7-2016.
3. C. Torres, « Les BCR sous-traitants, un instrument d’encadrement des flux », alain-bensoussan.com, 7-12-2016.

Article provided by:

• Eric Le Quellenec, Lawyer, Head of the IT Advisory department Lexing Alain Bensoussan Avocats

Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project

Director CPC project: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.org

VIEW PROJECT