underdatabehandlere

Underdatabehandler, or sub-data processor, is a term used in data protection law to describe a person or organization that processes personal data on behalf of a data controller and under the instruction of another processor. The sub-processor does not determine the purposes or means of the processing; it acts as an agent in the processing chain to help the main processor fulfill its obligations to the controller.

Legal framework and authorization

Under the GDPR, a processor may engage another processor only with the controller’s written authorization. If there is a general written authorization, the processor must inform the controller of intended changes and allow the controller to object to certain proposed sub-processors. The controller remains ultimately responsible for compliance and for ensuring that processing by any sub-processor aligns with the purposes and protections set out in the contract.

Contracts and obligations

The relationship between controller, processor, and sub-processor must be governed by written data processing agreements. These agreements typically specify the subject matter, purposes, categories of personal data, and data subjects, as well as the duration of processing. They set out the sub-processor’s confidentiality and security measures, the flow-down of data protection obligations from the processor to the sub-processor, and liability for acts of the sub-processor. Breach notification requirements and rights to audit or inspect are common features.

Security and transfers

Sub-processors must implement appropriate technical and organizational measures to protect personal data. If data are transferred outside the European Economic Area, appropriate safeguards such as adequacy decisions or standard contractual clauses must be in place.

Liability and oversight

The processor remains liable to the controller for the acts or omissions of the sub-processor performed on behalf of the controller. The controller can, under the contractual framework, object to or suspend processing by a sub-processor if protections are inadequate.

In practice, underdatabehandlere are common in service delivery, cloud, and outsourcing arrangements, where specialized providers handle data processing tasks on behalf of the primary processor.