Q1. Is there a requirement under GDPR for data processors to disclose sub-processing arrangements and the names of the organisations involved in this?
"The processor shall not engage another processor without prior
specific or general written authorisation of the controller. In the
case of general written authorisation, the processor shall inform the
controller of any intended changes concerning the addition or
replacement of other processors, thereby giving the controller the
opportunity to object to such changes." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 2
This clearly states that the processor would need to make clear that they are subcontracting the services and get permission for this as part of the contract, but doesn't specify whether the subcontractors must be named and identified. Perhaps there is other prior existing subcontracting legislation that requires them to be named? Some procurement contracts as supplied by controllers may specify a list of nominated (allowed) sub-contractors or require the full identification of sub-contractors though I've not found anything in law that requires they be named other than as part of a specific contractual obligation.
Q2. Is there a requirement under GDPR for data processors to disclose the country or countries where data is stored and processed?
"Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ... (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. ..." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 3(h)
This clearly states the data processor must make available to the data controller all details required to demonstrate compliance. It's quite likely larger organisations may choose to make this simple for data controllers by supplying this information in the form of a completed Data Privacy Impact Analysis document.
"Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: ... (e)
where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
..." -- EU General Data Protection Regulations (GDPR) Article 30 Paragraph 1(e)
This clearly states the data controller must maintain a record of the country or countries involved if any of these are outside the EU, and so this information must be made available to the controller as stated above.
