Do i have to disclose all processors to my controller? EU-GDPR

Question

I'm working as a processor, we host and develop an online information portal (analysis) for customers of different controllers (all working in the same kind of buisness).

The different controllers are sending us customer data (production data, something like the quality of an product).

This information we visualize for the customer. Now because of GDPR we have to disclose our own processors to the controllers. The problem is some of our controllers have an own "customer-quality-portal" so they are also competitors. If we disclose some of our processors (the developing ones) to them, they could also work with them and then we could lose some of our competitive advantage.

In short: Are there ways to comply with GDPR and not disclose all our processors to our controller?

Answer 1

Are there ways to comply with GDPR and not disclose all our processors to our controller?

The disclosure requirement is spelled out quite clearly in GDPR Article 28 (2):

The processor shall not engage another processor without prior specific or general written authorisation of the controller.

So if your subcontractors are processors, the answer is clearly: "No".

Article 4 of the GDPR contains some important definitions. The GDPR defines ‘processor’ as follows:

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

So, if your are not forwarding personal data to your subcontractors, they are not ‘processors’ (according to the GDPR), and you do not have to disclose them.

The GDPR Article 4 defines ‘personal data’ as follows:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

If your subcontractors are actually developing code on your behalf (on their own servers, or on yours), and they have access to production data about real people, then they are processors and must be disclosed. (IMHO, giving development and testing teams access to production data violates professional standards that predates the GDPR by several years.)

If they do not have access to production data, but are using fake data or anonymized production data for development and testing purposes, then they are not processors.

The key phrase is "identifiable". If the data processed by the third party does not let them identify the natural person, because the data is not about real people, or because all identifiers relating to real people are encrypted or otherwise transformed in a way that makes it impossible to identify the natural person, you do not have to disclose the third party you rely on, as that third party is not a processor.