MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
A sub-processor agreement is the GDPR-mandated agreement between a processor and a third party engaged by the processor (the sub-processor), stating how the latter may process personal data. If, for example, your processor engages a cloud provider, that chain must be covered by sub-processor agreements — and this is only permitted with the consent of the controller. Below, you can read what a sub-processor agreement is and what it should contain.
Who is a processor and who is a sub-processor?
If your company processes personal data, you must comply with the General Data Protection Regulation (GDPR). An important part of this is entering into data processing agreements — and sometimes sub-processor agreements as well. The roles:
- the controller determines the purpose and means of the processing and remains ultimately responsible;
- the processor processes personal data on behalf of the controller;
- The sub-processor is a third party engaged by the processor for (part of) that processing.
The controller ensures a proper data processing agreement with the processor; the processor, in turn, ensures proper sub-processor agreements with the parties it engages.
When do you need a sub-processor agreement?
As a processor, you are required to enter into a sub-processor agreement with sub-processors. In this agreement, you specify how the sub-processor processes the personal data, in accordance with the GDPR. Important: engaging a sub-processor is only permitted with the consent of the controller, which must be recorded in the processor agreement.
Example: Your SME (controller) uses a hosting provider (processor), which engages a cloud provider (sub-processor) for server management. You enter into a data processing agreement with the hosting provider; the hosting provider enters into a sub-processor agreement with the cloud provider.
What is included in a sub-processor agreement?
The agreement contains the rights and obligations regarding processing by the sub-processor, with binding agreements concerning:
- which personal data may or must be processed and in what manner;
- which security measures the sub-processor takes.
Important: the sub-processor agreement must align with the processor agreement and guarantee at least the same level of protection. This ensures that each party knows what to expect from the other and that the privacy of the data subjects remains safeguarded.
Frequently Asked Questions
May a processor simply engage a sub-processor?
No. That is only permitted with the consent of the controller, which must be stipulated in the data processing agreement.
Who concludes the sub-processor agreement?
The processor concludes this with the sub-processor. However, the data controller remains ultimately responsible for the protection of the data.
Must the sub-processor agreement offer the same level of protection?
Yes. The agreement must align with the data processing agreement and guarantee at least the same protection.
What if there is no sub-processor agreement?
In that case, there is a GDPR violation, with a risk of enforcement and liability in the event of data breaches or unlawful processing.
Drafting a sub-processor agreement or having it reviewed?
Drafting is complex: you must take into account the GDPR, the data processing agreement, the practical situation, and the agreements with the data subjects. Therefore, have a self-drafted agreement checked with our ContractCheck™, or have us draft it directly for you.
View our expertise in privacy and data protection or schedule a no-obligation consultation.
