A website owner is data controller. Most website owners are using web hosting companies, i.e. data processors. Each website owner must have a GDPR compliant privacy policy.
Must each website owner disclose which data processors are being used? Must each website owner list in its privacy policy which hosting provider is in use and where data is located?
No.
Art. 13 and Art. 14 lists the information to be provided to the data subjects. No information about the data processor needs to be provided.
However, the data controller must disclose its data processors to the supervisory authority when requested.
But there are specific situations where the data processor must be disclosed to the data subject, for example to request consent as specified in Art. 49(1)(a).
