Sub-processor
What is Sub-processor?
A third party engaged by a data processor to carry out specific processing activities on behalf of the data controller.
Terms that appear alongside sub-processor
Each of these is named in at least one of the same controls as sub-processor. The number is how many controls name both.
- gdpr 24 shared controls
- breach notification 23 shared controls
- audit 20 shared controls
- data protection 19 shared controls
- compliance 17 shared controls
- encryption 15 shared controls
- data subject 15 shared controls
- confidentiality 14 shared controls
Frameworks that govern sub-processor
What the standards actually require on sub-processor
Requirements naming sub-processor across 6 standards, quoted from the control text.
Sections 24-26 of the Jamaica DPA 2020 establish the framework for Joint Controllers + Processors + Sub-Processors + and Records of Processing Activities.
JM-DPA2020-Joint-Controller-Processor-Sec24-25-26-Arrangements-Allocation-Responsibilities-Contracts · Jamaica DPA 2020 Joint Controllers + Processors + Sections 24-26 + Arrangements + Allocation of Responsibilities + Contracts + Records of Processing Activities (ROPA) + Sub-Processors + Vendor Management →Tell the data owner which sub-processors will access their personal or sensitive data before that processing starts.
CCM-DSP-14 · Disclosure of Data Sub-processors →Processes, procedures and technical measures are defined, put in place and assessed so that the data owner is told about any sub-processor access to personal or sensitive data before that processing begins.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::DSP-14 · Disclosure of Data Sub-processors →Section 5 of Kentucky CDPA establishes the Processor Contract framework + closely modelled on VCDPA Virginia + GDPR Article 28. (1) Section 5 Processor Definition: (a) Person processing personal data on behalf of controller;
KY-CDPA-Processor-Contracts-Section5-Confidentiality-Subprocessor-Authorisation-Audits-Sub-Processor · Kentucky CDPA Processor Contracts + Section 5 + Confidentiality + Subprocessor Authorisation + Audits + Sub-Processor Flow-Down + Documented Instructions + Data Deletion + Cooperation + Mandatory Contract Terms →A controller may use only processors providing sufficient guarantees of appropriate technical and organisational measures. A processor may not engage another processor without the controller's prior specific or general written authorisation and, under general...
montenegro-law-on-personal-data-protection-2026::29(1) · Article 29(1), (2), (4) and its final paragraph: choosing processors with sufficient guarantees and authorising sub-processors →The controller may use only processors giving sufficient guarantees of appropriate technical and organisational measures. Processing must be governed by a written contract, law or sub-legal act setting out subject matter, duration, nature and purpose, data typ...
albania-law-no-124-2024-on-personal-data-protection::26 · Article 26: processors, their contracts and sub-processors →Questions people ask about sub-processor
What is Sub-processor?
Why is Sub-processor important for compliance?
Which compliance frameworks address Sub-processor?
Where can I learn more about Sub-processor?
See how Sub-processor applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.