What are the GDPR obligations for subcontracting companies?

The answer to the survey: "Must the processor mandatorily keep a register of processing activities?"

On the occasion of a survey conducted on November 9th on our LinkedIn page, we asked you whether a processor must imperatively maintain a processing register.

You were right! Out of 157 voters, 92% of you voted yes. This is indeed the correct answer, the processor must maintain a processing register.

Article 30 of the GDPR requires the processor to maintain a so-called subcontracting register. This is similar to the processing register that falls under the activities of the data controller. However, these registers do not contain exactly the same information. The information that must appear in the subcontracting register according to the GDPR is as follows:

· identities of the data controller and the processor,

· category of processing,

· transfer outside the European Union,

· security measures implemented.

What are the obligations of the subprocessor?

1. The obligation of transparency and traceability

The processor has an obligation of transparency and traceability of data towards the controller who delegates all or part of their activity to them. Article 28 of the GDPR recommends establishing a contract between the parties setting out their mutual obligations.

The processor must demonstrate their compliance efforts to the controller by conducting audits and maintaining a processing register, for example.

The processor must guarantee that the data is processed according to the controller's instructions.

2. The obligation to respect the essential principles of the GDPR

The processor must ensure that the tools they use comply with the principles of privacy by design and privacy by default. That is to say, from their conception and by default, they comply with the GDPR.

3. The obligation to guarantee the security of the data being processed

The processor must guarantee that the data they use is processed in a manner capable of ensuring an adequate level of security and confidentiality relative to the risks incurred for the data subjects due to the processing. They must also implement technical and organizational measures capable of ensuring such a level of security, notably by implementing physical and logical security measures.

4. The obligation to alert, advise and assist

The processor has a duty to advise the controller on the use of data. They must also alert them in case of risk, such as in the event of a security incident. They must also assist them if necessary in case of a request to exercise rights. Generally speaking, they are subject to an obligation of collaboration to assist the controller. It is advisable to precisely define in the contract the modalities and scope of this collaboration to avoid any difficulty when it needs to be implemented.

# Data Comply One software (formerly Mission RGPD) and subprocessors The Data Comply One software (formerly Mission RGPD) and subprocessors

With Data Comply One (formerly Mission RGPD), you can audit your subcontractors using our audit templates. You also have the option to create your own customized audits.
If you are yourself a subcontractor, Data Comply One (formerly Mission RGPD) guides you in creating your subcontracting register and your incident register.
Don't waste any more time, it's so simple!