Latest EDPB Opinion: What You Need To Know About Using Processors And Sub-Processors

On October 9, 2024, the European Data Protection Board (“EDPB”) issued an Opinion 22/2024, offering guidance on the use of processors and sub-processors by controllers. Here are the key takeaways:

If Your Business Acts as a Controller

• You Make the Final Call: Your processor might recommend using a particular sub-processor, but the ultimate decision rests with you. You're responsible for ensuring that sufficient guarantees are in place with your processor to ensure the sub-processors protect the rights of data subjects under Article 28(1).
• Keep Information to Hand: If your processor relies on sub-processors to process data for you, you need to have detailed information about them readily available. This includes their name, address, and a contact person. It's not just for good practice—it is needed to ensure compliance with Article 28(1) of the GDPR (i.e., to ensure you have the requisite information when approached by a supervisory authority or a