What are the obligations of a processor that engages a sub-processor?

Question

Options

• AThe processor must give the controller prior written notice and perform a preliminary audit of the
• BThe processor must obtain the controller's specific written authorization and provide annual
• CThe processor must receive a written agreement that the sub-processor will be fully liable to the
• DThe processor must obtain the consent of the controller and ensure the sub-processor complies

• A
  3% (1)
• B
  13% (4)
• C
  7% (2)
• D
  77% (23)

Explanation

According to Article 28(2) of the GDPR, the processor may not engage another processor (sub- processor) without the prior specific or general written authorization of the controller. In the case of general written authorization, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. Furthermore, Article 28(4) of the GDPR states that where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR. Therefore, the processor must ensure that the sub- processor complies with data processing obligations that are equivalent to those that apply to the processor.

No community discussion yet for this question.