Processor and subprocessor: securing the audit trail and instruction evidence

A processor may use subprocessors for particular processing steps, but it must organise their involvement through a reliable control chain. The controller needs a coherent view of the service scope, data access, instructions, safeguards and audit evidence so that processing remains traceable through the last provider in the chain.

The focus is the review before and during engagement. Article 28 GDPR requires suitable guarantees, documented instructions, continuing data protection duties and evidence of compliance. This article addresses the audit trail and instruction evidence. The prior SaaS role assessment and the response to an actual personal data breach remain separate topics.

The review starts with a concrete description. Record the subprocessor’s task, systems, data types, data subject groups, location and planned access. Support, remote maintenance, backups and disaster recovery belong in the data flow where the provider can reach personal data through them.

Article 28(3) GDPR requires the subject matter and duration, nature and purpose of processing, data types and categories of data subjects to be described. Those details must remain visible in the chain. A company list does not show which provider performs which part of the processing.

Before using a further processor, the first processor needs the controller’s prior specific or general written authorisation. With a general authorisation, it must inform the controller about planned changes and give the controller an opportunity to object. Keep the authorisation and its supporting documents findable in the review file. Written form can also be electronic.

The topic page on processors and service providers explains the organisational framework. This review assumes that the underlying processing has already been classified and concentrates on the provider further down the chain.

The first processor may select a subprocessor, but it must be able to explain why that provider is suitable for the concrete processing. Article 28(1) GDPR requires sufficient guarantees for appropriate technical and organisational measures and compliance with the Regulation. The assessment therefore relates to the task, data, access and risk of the individual processing step.

The review file may include permissions, encryption, logging, environment separation, restoration, deletion and security governance. Certificates or provider questionnaires can support the assessment. Their value depends on whether scope, period and the provider’s actual service are covered.

Article 32 GDPR requires a level of security appropriate to the risk. The review should therefore link the provider evidence to the actual data flow. Special categories of data, broad administrator rights or several links in the chain call for correspondingly precise reasoning.

Under Article 28(3)(a) GDPR, the processor processes personal data only on documented instructions from the controller, unless Union or Member State law requires otherwise. The first processor must pass this binding on to the subprocessor. The sub-contract should therefore describe purposes, data scope, permitted operations, access groups and deletion or return rules in usable terms.

Article 32(4) GDPR extends the chain to natural persons who have access to personal data. They may process data only on instructions unless a legal duty applies. In practice, the evidence must connect the controller’s instruction to the processor’s responsible staff and the authorised users who can access the data.

Also review how new instructions are issued, acknowledged and implemented. A ticket, approved instruction or versioned annex can carry the evidence when its content, sender, recipient, time and processing step remain identifiable. Internal product labels do not provide those details on their own.

Article 28(3)(h) GDPR requires the processor to provide information needed to demonstrate compliance and to allow and contribute to reviews, including inspections, by the controller or an appointed auditor. The agreement should connect the review to the service, available evidence and the relevant risk.

A useful audit file can combine the agreement schedule, service description, current subprocessor list, security evidence, instruction records, review reports and open actions. Each finding should show who assessed it, what remediation was agreed and whether implementation was checked later.

The GDPR does not set one general statutory audit interval. Frequency and depth depend on the processing, risk, changes and previous findings. The processor checklist helps organise the material. It does not replace the risk-based decision on the scope and trigger of a review.

Article 28(4) GDPR requires the further processor to assume the same data protection duties that the first agreement places on the processor. Depending on the processing, this includes instructions, confidentiality, security, assistance, evidence and return or deletion.

The flow-down must be testable. Compare the main agreement with the sub-contract and mark differences in access, subprocessing, incident notification, support for data subject rights and end-of-service handling. The first processor remains liable to the controller for the further processor’s compliance with those duties.

This responsibility does not remove the need to examine the facts. It identifies where evidence must be obtained and actions followed up. The SaaS role article comes earlier in the analysis and helps determine whether and to what extent Article 28 applies to the main provider.

The review does not end when the sub-contract is signed. New systems, additional access, changed locations, different deletion routines or a changed service can alter the original assessment. Define signals that trigger a comparison of service description, instructions, safeguards and audit evidence.

Article 28(2) GDPR concerns information about planned changes involving further processors and the opportunity to object. The specific replacement of an existing subprocessor is covered separately in the article on prior notice and response periods. This article focuses on ongoing control and evidence.

A security incident adds its own reporting and investigation process. The article on processor data breaches covers prompt information to the controller and the joint assessment. Audit evidence may support that work, but it does not replace the incident review.

Processing: Record the task, data types, data subject groups, systems, locations and access of the subprocessor.

Instructions: Link documented instructions, permitted purposes, access groups, confidentiality and deletion or return rules to the processing step.

Safeguards: Assess technical and organisational measures against the actual risk and service. Record open evidence with an owner and follow-up point.

Audit: Set information rights, review triggers, contacts, reporting, remediation and follow-up. The GDPR provides no single general interval.

Chain: Compare the main agreement with the sub-contract. Recheck whether data flow, instructions, safeguards and evidence still match after changes.

We review the processing step, data flow, instructions, safeguards, sub-contract, audit evidence and open actions together. For an initial assessment, use the processing agreement, current provider list, service description, instruction records and security material from the subprocessor. This shows which evidence is still needed before approval and how ongoing control can be organised.