Is verification of a sub-processor necessary when acting as a processor?

ANSWER

Under Article 28(4) GDPR, the processor has an obligation to conclude a sub-processing agreement with a further processor. Moreover, if another processor fails to fulfil its data protection obligations, full responsibility towards the controller for fulfilment of that other processor's obligations rests with the original processor. It should therefore be concluded that when acting as a processor, verification of the further processor is necessary in order to safeguard one's interests.