A data processor that handles personal data tor multiple customers has decided to migrate its data warehouse to a third-party provider. What is the processor obligated to do prior to implementation?

GDPR Article 28(2) requires that a processor shall not engage another processor (sub-processor) without the prior specific or general written authorization of the data controller. Migrating a data warehouse to a third-party provider constitutes engaging a new sub-processor, making controller approval a mandatory legal obligation that must be fulfilled before implementation begins.

Obtaining assurance about data subject request handling is a good practice but is secondary to the legal requirement to obtain controller approval before engaging a new sub-processor.

Implementing industry-standard encryption is a security best practice but is not the specific legal obligation triggered by onboarding a new sub-processor.

Documenting data retention periods is a general compliance requirement but is not the primary obligation created by introducing a new sub-processor into the processing chain.