Set by the law · GDPR Art. 28(2)
Sub-processor
In plain English
Another processor that a processor brings in to help process the data. This needs the controller's prior written authorisation, and the first processor stays fully liable for it.
The official text
The processor shall not engage another processor without prior specific or general written authorisation of the controller.
Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.
197 decisions on Fino cite Article 28 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.