Commercial
Sub-processor
A supplier's own supplier that also touches your data.
Definition
Any third party a processor engages to help deliver the service, where that party also handles personal data: hosting providers, ticketing tools, analytics, subcontracted staff. Under GDPR the client must be informed of them and normally has a right to object.
Why it matters
Your data footprint is the whole chain, not just the company you signed with. Ask for the sub-processor list and the notification process for changes. The recurring failure is a provider adding a new tool mid-engagement, moving customer data into a system you never assessed and could not have named.
Related
Read next
Data processing agreement
The contract governing what a supplier may do with personal data.
Read the definition ›GDPR
The EU regulation governing how personal data may be handled.
Read the definition ›Data residency
Where your data physically sits, and which laws follow from that.
Read the definition ›Subcontracting
Your provider passing part of the work to another company.
Read the definition ›Next step
Ready to build or scale your team?
Tell us what you need and we will match you with pre-vetted Lebanese professionals ready to integrate with your team.