european-union data-protection
Resellers under GDPR - disclosure of data processors or countries of data storage?
<p>A significant number of web-design and I.T. consultancy companies typically re-sell third party services related to their own as part of their product/service portfolio, to give a few examples, website hosting, domain names, email hosting, VOIP phone services etc. Sometimes these may be white-labelled services promoting the reseller's brand and hiding the fact they don't provide the service directly themselves. This is good for resellers as it increases their service portfolio and turnover, good for customers because it reduces their involvement in the complex technical arrangements and enables a sort of one-stop shop for their I.T. requirements, however these resellers would definitely be data processors themselves under the GDPR.</p>

<p>In the insurance world, it is required for companies to publish/disclose the name of the company that underwrites the insurance. Is there any similar requirement under GDPR for data processors (resellers in this case) to disclose the country or countries where the data is stored and processed, or the names of third party data processors involved? I'm struggling to find anything to this effect but without such a requirement it makes compliance very difficult for data controllers (and processors looking to sub-contract to further data processors) when shopping around for compliant solutions if this information is not disclosed/published prior to enquiring.</p>

<p><strong>Q1. Is there a requirement under GDPR for data processors to disclose sub-processing arrangements and the names of the organisations involved in this?</strong></p>

<blockquote>
  <p>"The processor shall not engage another processor without prior
  specific or general written authorisation of the controller. In the
  case of general written authorisation, the processor shall inform the
  controller of any intended changes concerning the addition or
  replacement of other processors, thereby giving the controller the
  opportunity to object to such changes." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 2</p>
</blockquote>

<p>This clearly states that the processor would need to make clear that they are subcontracting the services and get permission for this as part of the contract, but doesn't specify whether the subcontractors must be named and identified. Perhaps there is other prior existing subcontracting legislation that requires them to be named? Some procurement contracts as supplied by controllers may specify a list of nominated (allowed) sub-contractors or require the full identification of sub-contractors though I've not found anything in law that requires they be named other than as part of a specific contractual obligation.</p>

<hr>

<p><strong>Q2. Is there a requirement under GDPR for data processors to disclose the country or countries where data is stored and processed?</strong></p>

<blockquote>
  <p>"Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that <strong>the processor</strong>: ... (h) <strong>makes available to the controller all information necessary to demonstrate compliance</strong> with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. ..."  -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 3(h)</p>
</blockquote>

<p>This clearly states the data processor must make available to the data controller all details required to demonstrate compliance. It's quite likely larger organisations may choose to make this simple for data controllers by supplying this information in the form of a completed Data Privacy Impact Analysis document.</p>

<blockquote>
  <p>"Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: ... (e)
  where applicable, transfers of personal data to a third country or an international organisation, <strong>including the identification of that third country</strong> or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
  ..." -- EU General Data Protection Regulations (GDPR) Article 30 Paragraph 1(e)</p>
</blockquote>

<p>This clearly states the data controller must maintain a record of the country or countries involved if any of these are outside the EU, and so this information must be made available to the controller as stated above.</p>
