What's a subprocessor in the GDPR?

In the context of the General Data Protection Regulation (GDPR), a subprocessor is a third-party service provider that processes personal data on behalf of another organization, known as the data controller. The GDPR sets out specific rules and requirements for the use of subprocessors, including the need for a written contract between the data controller and the subprocessor.

Under the GDPR, the data controller is responsible for ensuring that any subprocessors it uses provide an adequate level of protection for the personal data they process on its behalf. This means that the data controller must carefully select its subprocessors and put in place appropriate contractual safeguards to protect the personal data.

Some examples of subprocessors under the GDPR include cloud service providers, payment processors, and data centers. Any organization that uses subprocessors to process personal data must have a written contract in place with each subprocessor that sets out the rights and obligations of both parties with respect to the processing of personal data. This contract, known as a data processing agreement, must include specific provisions required by the GDPR, such as the requirement that the subprocessor only processes the personal data in accordance with the instructions of the data controller and the requirement that the subprocessor assist the data controller in meeting its GDPR obligations.

It is important to note that the use of subprocessors is not prohibited under the GDPR. However, the GDPR places certain responsibilities on data controllers to ensure that their subprocessors provide an adequate level of protection for the personal data they process on their behalf. Therefore, if you operate a business that collects and processes personal data from individuals in the EU, and you use subprocessors to help you with this processing, it is important to understand your obligations under the GDPR and take steps to ensure that you are compliant.