In the record of processing activities, should only processors from third countries be recorded, or also sub-processors?

ANSWER

The provision of Article 30(1)(e) GDPR indicates the obligation to include in the record of processing activities information concerning transfers of data to a third country.

Scholarship accepts that "Where the data controller transfers data to a third country or an international organisation, it has an obligation to include in the record of processing activities information on the transfer of personal data to a third country or international organisation, in particular by indicating the name of the country or organisation.

Scholarship postulates that, although the obligation to provide this information does not follow directly from the provision commented on, the record should also include legal bases, which stems from the rationale for maintaining the record to demonstrate the legal basis for processing (W. Kotschy, in: The EU General Data Protection Regulation, p. 620)." — Litwiński, commentary on Article 30 GDPR, 2021.

Within the record of processing activities, apart from indicating the country to which personal data are transferred, the controller should also indicate the legal basis; in this situation it will be a data processing agreement or sub-processing agreement. Both the processor and the sub-processor should therefore be indicated.