Should a complete list of processors or sub-processors be written anywhere for GDPR compliance? If so, who is required to do so? Controllers, processors, sub-processors? And where should the list be written? Privacy policies, data processing agreements (DPAs), other documents?

Quoting article 28, paragraph 2, it seems sub-processors must be written in DPAs between a controller and a processor, but it's not clear to me whether the sub-processors list should be explicit or not:

The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

In all other cases I'm not sure whether any processors or sub-processors should be written anywhere. For example, I didn't find any information about listing processors in privacy policies.

I found a related question here about a specific case, but what I'm asking is more general.

1 Answer 1


Basically it goes like so: Controller must specify all joint controllers, processors and sub processors. A controller may include this in their privacy policy but if that’s where the information is located consent must be obtained that the privacy policy was agreed to. Additionally the controller must record the privacy policy which was agreed to.

Processors must have DPAs with controllers specifying all their processors. They can place this in their privacy policy but must be consent at the time of DPA signing that the policy has been agreed to and record the specific policy that was agreed to.

  • A controller must know and record all the processors, and will be able to know and record all the sub-processors as well, since they will be listed in the processors' DPAs. But that's where it ends, I guess. I don't think a controller is required to know and record all the sub-sub-sub-sub... processors. Am I right? It would be impossible in practice, or a huge mess anyway.
    – reed
    Commented Jun 19, 2018 at 9:59
  • Technically speaking you only need to list the information you have. IE you have a DPA with a processor and they list their sub processors. Those sub processors would need to be listed on your end as you have that information.
    – Shinrai
    Commented Jun 28, 2018 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .