Subprocessors and DPAs

Audit Rights Audit rights are your contract right to check that a vendor keeps its data protection promises. In practice, many vendors offer a SOC 2 report or similar document first and allow on-site audits only under conditions. Breach Notification Clause A breach notification clause says when and how a vendor must tell you about a security problem affecting your data. Under the GDPR the vendor must tell you without undue delay, and you then generally have 72 hours to tell the regulator. Description of Processing (Annex I) The description of processing is the part of a DPA, often Annex I, that lists what data the vendor handles, about whom, for what purpose and for how long. Documented Instructions Documented instructions are your written directions to a vendor about what it may do with your data. Under GDPR Article 28(3)(a), a processor may only process your data on those instructions. Flow-Down Obligations Flow-down obligations are the duties your vendor must pass on to the companies it hires to handle your data. Under the GDPR, those subprocessors must take on the same data protection duties, and your vendor stays liable for them. GDPR Article 28 GDPR Article 28 is the EU privacy law rule that says what must be in the contract between a business and a vendor that handles personal data for it. That contract is usually called a data processing agreement, or DPA. General vs Specific Subprocessor Authorization Under GDPR Article 28(2), specific authorization means you approve each subprocessor by name, while general authorization means you approve in advance and the vendor must tell you about changes so you can object. Right to Object to a New Subprocessor The right to object lets you push back when a vendor plans to add a new company that handles your data. In many contracts, if the vendor goes ahead anyway, your only remedy is to stop using the affected service. Subprocessor A subprocessor is a company your vendor hires to handle your data for it, such as a cloud host or an AI model provider. You have no contract with it, so your vendor's data processing agreement sets the rules. Subprocessor Change Notification A subprocessor change notification is the advance notice a vendor gives before it adds or replaces a company that handles your data. Your DPA sets how many days you get, how notice is sent and whether you can object. Technical and Organizational Measures (TOMs) Technical and organizational measures (TOMs) are the security steps a vendor promises to take to protect your data, such as encryption, access controls and staff training. They are usually listed in an annex to the DPA.