Sub-processors are third-party entities that data processors engage to handle personal data on behalf of controllers. They are vital in the modern business supply chain, particularly as businesses increasingly adopt cloud-based solutions. Cloud storage platforms are a prime example of such sub-processors.
However, involving sub-processors who access personal data comes with stringent legal obligations. A solid understanding of the UK GDPR framework and practical strategies to address operational challenges is essential to manage these relationships effectively and ensure compliance.
Sub-processing agreements can be complex and often involve extensive negotiation. The intricate nature of supply chains, combined with the strict requirements of data protection laws, doesn’t always align seamlessly with real-world practices. Navigating these challenges often requires a blend of legal expertise and a pragmatic approach.
Our team of data protection lawyers is here to help you navigate the legal and practical challenges of managing sub-processor agreements and relationships under the UK GDPR, offering straightforward advice that works in the real world.
Contents:
Appointing and changing sub-processors
Sub-processors are typically third-party suppliers engaged by processors to handle personal data on behalf of controllers (cloud storage providers are a key example).
The UK GDPR sets out important restrictions to stop processors from engaging sub-processors without prior specific or general written authorisation of the controller i.e.:
- With specific authorisation, the controller must approve each sub-processor individually. This means they have maximum control.
- On the other hand, general authorisation means controllers will pre-approve a list of sub-processors or criteria for selecting sub-processors. They can receive notifications of changes and make objections to them.
The choice between specific and general authorisation can depend on practical factors, such as bargaining power and how the processor operates in practice, so this isn’t a one-size-fits-all approach.
Controllers with more leverage working with smaller suppliers may be able to insist on the specific authorisation route for tighter control over data processing in supply chains. However, larger processors with established supply chains will typically require general authorisation due to operational constraints and the fact that they already operate depending on several third-party processors.
Overall, this can be a heavily negotiated point. For example, the controller wants control, but the processor needs flexibility, as giving absolute discretion to their controller customer won’t work with long supply chains.
When a processor intends to add or replace a sub-processor under general authorisation, the UK GDPR requires them to notify the controller in writing to give them the right to object by a certain date. Controllers will need sufficient time to assess the proposed change and, if necessary, raise objections. This can also be tricky in negotiation and practically – e.g. how can a processor completely reliant on a sub-processor accommodate objections in practice?
Parties need to find a way forward by considering the practicalities of their projects and reaching a resolution.
Controller-to-processor contracts: Addressing sub-processing terms
Contracts between controllers and processors should be drafted carefully to manage sub-processor relationships.
The contract terms need bespoke drafting to meet the practical arrangements for appointing sub-processors (e.g., stating if the controller denies using a sub-processor or agrees to give specific or general authorisation).
Contracts can include key provisions such as:
- Prohibiting sub-processors entirely
- Requiring pre-approval of a list of sub-processors
- Granting prior written authorisation with rights to object within a set timeframe.
Negotiating these terms can, again, get complicated. Smaller service providers might find controllers push for more say over who can access their data, especially when it’s sensitive. On the other hand, larger established processors will often come with their own standard terms on sub-processing on a ‘take it or leave it basis’.
Key legal responsibilities when appointing sub-processors
Appointing sub-processors raises a range of legal challenges that both data controllers and processors must consider carefully to ensure compliance with data protection laws. Here are some key issues to keep in mind:
For you as a processor
- Liability risks: You will be fully liable to controllers for performing your sub-processors' obligations. If a sub-processor fails to comply with legal requirements or mishandles data, you could have a big problem.
- Due diligence: You’ll need to conduct thorough due diligence when choosing sub-processors to ensure they meet the UK GDPR’s strict data protection standards. This means reviewing their security measures, employee training programmes, and how they’ll secure the data you pass to them. Regular audits and detailed records of your evaluations and appointments are also essential. While this can be challenging if you work with long or complex supply chains, ensuring data is secure at every level is critical.
- Sub-processing agreements: You must establish strong agreements with your sub-processors to reflect mandatory data protection requirements and manage risk effectively. This includes flowing down the same—or equally robust—data protection terms you’ve agreed with your controller to your sub-processors. Controllers often insist on this. However, this can get tricky in practice, especially with global sub-processors like large tech companies that typically enforce their standard terms. You’ll also need to ensure that sub-processors only process data according to the controller’s original instructions.
- International data transfers: Things get even more complex if your sub-processors are based outside the UK, triggering international data transfer requirements. You’ll need to ensure these arrangements are structured properly and comply with the law while keeping clear documentation of your efforts to stay compliant.
For you as a controller
- Oversight and transparency: You will need to understand exactly where your data is going with your own due diligence, e.g., to ensure you have proper oversight on sub-processors to verify they have sufficient guarantees that their data processing will be UK GDPR compliant. You typically rely on your processor’s due diligence findings to understand this. You might insist on seeing sub-processing agreements to verify compliance, too – so your processors must have this covered.
Managing sub-processor relationships under UK GDPR can be complex, especially when working with long or international supply chains. Balancing strict legal requirements with business realities often calls for expert legal advice. This is essential for drafting and negotiating agreements that ensure compliance and work for your operations.
Managing sub-processor relationships
Managing sub-processors effectively needs proactive planning, open communication and sometimes creative solutions.
In the modern business market, processors are increasingly pushing for a controller’s general authorisation to appoint sub-processors but granting visibility (e.g., by giving their customers a list of sub-processors to sign off). In this case, it’s crucial to have a smooth and efficient procedure for notifying and handling objections to changes.
Parties need to understand how to comply with their legal obligations while meeting the practical realities of doing business. This will often require collaboration and compromise, and legal advice can help parties understand risks, reach a solution, and structure their agreements to align with legal requirements and operational realities so they can do business.
Balancing compliance and practical business needs
Sub-processor relationships are integral to modern supply chains but have significant compliance challenges. While achieving 100% compliance may not always be practical, businesses must still find ways to operate effectively while mitigating risks.
When the demands of operational realities conflict with strict legal requirements, the focus should shift to practical, balanced solutions that align compliance with business needs. Given these complexities, seeking legal advice is strongly recommended. Our data protection team is ready to assist if your business requires support.
