Unterauftragsverarbeiter

What applies to sub-processors?

The GDPR regulates the chain in Art. 28. The processor may only engage further service providers with your authorization, either separately in individual cases or in general. With a general authorization, it must inform you of planned changes so that you can object. The contract with the sub-processor must contain the same data protection obligations as in the data processing agreement. If the sub-processor does not fulfill its obligations, the first processor is liable to you. In everyday language, people also speak of subcontractors. This entry does not replace legal advice.

Sub-processors in IT retirement

The more stations a data carrier passes through, the longer the chain becomes that you have to keep track of. Typical questions to a service provider are therefore: Who transports the devices? Where are they erased or destroyed? Who handles recycling, and only after erasure or already before? Have the engaged companies named to you and check whether their technical and organizational measures are suitable. Further checking questions are provided by the guide Choosing an ITAD provider.

Second IT picks up devices with its own secure logistics. Erasure and data carrier destruction take place in-house in Schwäbisch Hall, without transport to external sites. This keeps the chain short.

Frequently asked questions about sub-processors

Do I have to authorize every sub-processor individually?

Not necessarily. A general written authorization is also possible. In that case, however, the processor must inform you of every planned change so that you can object.

Is a freight forwarder a sub-processor?

That depends on the individual case. If it transports data carriers containing personal data on behalf of the service provider, it is often classified as a sub-processor. Clarify the classification with your data protection officer.

Who is liable if a sub-processor makes mistakes?

Toward you, the processor that engaged the sub-processor is liable (Art. 28(4) GDPR).

What distinguishes a processor from a sub-processor?

The processor works directly for the controller. The sub-processor is engaged by the processor and takes over part of the processing. It needs your prior written authorization and must fulfill the same data protection obligations.

How do I check my service provider's sub-processors?

Have the engaged companies named to you. Ask who transports, where erasure or destruction takes place and who recycles. Check whether their technical and organizational measures are suitable. The shorter the chain, the easier it is to keep track.