Is a Processor Required to Inform the Controller About the Sub-processor(s) It Engages?
ANSWER
Yes. Under Clause 7.7 of the SCCs, the parties must choose one of two options:
- OPTION 1: prior specific authorization; or
- OPTION 2: general written authorization.
In both cases, the processor must provide the controller with the name(s) of the specific sub-processor(s) so that the controller can decide whether to authorize them. It is not sufficient for the processor to provide only categories of sub-processors.
It is up to the parties to agree on:
- the timeframe within which the processor must request prior specific authorization (OPTION 1); or
- the timeframe within which the processor must inform the controller of any intended changes to the agreed list of sub-processors (OPTION 2).
The above answer is based on an official document of the European Commission.
You can review it at: https://ec.europa.eu/info/sites/default/files/questions_answers_on_sccs_en.pdf
A translated version of this document is also available on our blog under the title: "Standard Contractual Clauses (SCCs) – Questions and Answers".
