GDPR and third-party risk: Article 28, sub-processors, and transfers

GDPR (Regulation (EU) 2016/679) applies wherever the processing touches an EU data subject - Article 3 pulls in a vendor's activities regardless of where the vendor is established, as long as it is offering goods or services to, or monitoring, people in the EU. Almost every SaaS vendor, cloud host, or contractor that touches your customer or employee data is acting as a processor on your behalf as controller, a distinction the EDPB's Guidelines 07/2020 on the concepts of controller and processor work through in detail. That relationship only becomes lawful once a compliant contract is in place - which is why the data processing agreement (DPA) is the single most load-bearing document in a GDPR-driven vendor program.

The Article 28 processor contract

Article 28(3) requires the contract to set out the subject-matter and duration of the processing, its nature and purpose, the type of personal data and categories of data subjects, and the controller's own obligations and rights - then stipulate that the processor:

• Processes only on documented instructions from the controller, including for any transfer to a third country - Article 28(3)(a).
• Binds its staff to confidentiality - 28(3)(b).
• Implements Article 32 security measures proportionate to the risk - 28(3)(c).
• Respects the sub-processor conditions in 28(2) and (4) - 28(3)(d), covered below.
• Assists with data-subject rights requests - access, erasure, portability, and the rest of Chapter III - 28(3)(e).
• Assists with security, breach-notification, and DPIA obligations under Articles 32-36 - 28(3)(f).
• Deletes or returns all personal data at the controller's choice once the engagement ends, and deletes existing copies unless EU or member-state law requires retention - 28(3)(g). This is the clause that makes vendor offboarding enforceable rather than a matter of trust.
• Makes compliance evidence available and submits to audit, including inspections by the controller or an auditor it mandates - 28(3)(h).

A vendor's SOC 2 report or ISO 27001 certificate can evidence some of these controls, but neither substitutes for the contract itself - Article 28 is a binding legal instrument between two named parties, not a control framework a vendor can simply attest to.

Sub-processors: authorization and flow-down

A processor cannot bring in a sub-processor - a fourth party from the controller's vantage point - without the controller's prior authorization under Article 28(2). That authorization can be specific (approve each one by name) or general (approve the practice, but the processor must then notify the controller of intended additions or replacements and give it a real opportunity to object). Whichever model is in the contract, Article 28(4) requires the same data-protection obligations to flow down to the sub-processor by contract, and if the sub-processor fails to meet them, the original processor - not the sub-processor - remains fully liable to the controller. In practice this means a vendor's published sub-processor list is not paperwork to file away; it is the input a TPRM program needs to track which fourth parties actually touch its data and whether the vendor's own flow-down contracts are current.

Cross-border transfers

Chapter V governs any transfer of personal data to a vendor - or a vendor's sub-processor - outside the EU/EEA. Article 44 sets the general principle that a transfer may only happen if the rest of the chapter is satisfied; Article 45 allows transfers without further safeguards where the European Commission has issued an adequacy decision for the destination; absent one, Article 46 requires appropriate safeguards, most commonly the modular Standard Contractual Clauses adopted in Commission Implementing Decision (EU) 2021/914 or binding corporate rules; Article 49 provides narrow derogations (explicit consent, contract necessity) meant for occasional transfers, not as a standing basis for an ongoing vendor relationship. Since the CJEU's Schrems II ruling, relying on SCCs for a transfer to a country without an adequacy decision also requires a documented transfer impact assessment of that country's surveillance and access laws - a step vendor diligence has to capture, not assume away.

Breach notification and enforcement

Article 33(2) requires a processor to notify its controller without undue delay after becoming aware of a personal data breach - there is no fixed hour count for the processor, but it exists to let the controller meet its own 72-hour deadline to notify the supervisory authority under Article 33(1). A vendor that discovers and triages incidents slowly, or a program that only learns of a vendor breach from the news, cannot meet that clock; this is a large part of the case for continuous vendor monitoring rather than annual reviews. Enforcement is tiered by which article is breached: under Article 83(4), a violation of the Article 28 processor obligations tops out at €10 million or 2% of global annual turnover, whichever is higher; under Article 83(5), a violation of the Chapter V transfer rules tops out at €20 million or 4% - a distinction worth knowing, since a defective DPA and an unlawful transfer carry different regulatory exposure even when they arise from the same vendor relationship.

Turning GDPR into TPRM actions

• Classify vendors by data touch, not spend. Any vendor processing personal data on your behalf needs an Article 28 DPA before onboarding, regardless of contract size - see vendor tiering.
• Track sub-processors as inventory, not disclosure. Pull each vendor's published sub-processor list and treat additions as an authorization event, not a notice to file.
• Map transfers before signing. Know which vendors and sub-processors move data outside the EU/EEA, and confirm the transfer mechanism - adequacy, SCCs with a transfer impact assessment, or BCRs - is actually in place, not just referenced.
• Build breach-notification timelines into contracts tight enough that "without undue delay" from the vendor still leaves room to meet your own 72-hour clock.
• Confirm the deletion clause on offboarding - Article 28(3)(g) is only useful if someone actually verifies data was returned or destroyed when the relationship ends.

None of this requires a particular platform - it requires a current vendor and sub-processor inventory, evidence that DPAs and transfer mechanisms are actually signed rather than assumed, and fast enough visibility into vendor incidents to meet the 72-hour clock. Rescana is built around that continuous, evidence-based model, and providers such as OneTrust and ProcessUnity focus more specifically on privacy and DPA workflow; the fit depends on whether the harder problem in your program is unlawful data flows going undetected or downstream compliance paperwork going untracked.

Frequently asked questions