On 7 October 2024, the European Data Protection Board (EDPB) published Opinion 22\/2024, shedding new light on the responsibilities of data controllers when working with processors and sub-processors under the General Data Protection Regulation (GDPR).<\/p>\n
As the digital supply chain grows more complex-with cross-border transfers, layered outsourcing, and AI-based service providers-this guidance is both timely and far-reaching. By April 2025, all data controllers should have taken active steps to align with these expectations.<\/p>\n
Key Takeaways from the EDPB<\/strong><\/p>\n Comprehensive Identification:<\/strong> Controllers must maintain an updated register of all processors and sub-processors-including names, addresses, and contact details-to ensure effective oversight and facilitate data subject rights.<\/p>\n (i) Verification of Guarantees<\/strong>: Processors and sub-processors may only be engaged if they offer sufficient guarantees of GDPR compliance. This verification is not a one-off event: it must be proportionate to the risk and reviewed at regular intervals.<\/p>\n Contractual Clarity<\/strong>: Data Processing Agreements (DPAs) must state clearly that processors act only on documented instructions, unless legally required otherwise by EU or national law. While quoting the GDPR is not mandatory, the clause must be legally equivalent in effect.<\/p>\n International Data Transfers<\/strong>: Controllers remain accountable for data transfers outside the EEA initiated by their (sub-)processors. This includes conducting transfer impact assessments and applying supplementary measures where needed.<\/p>\n What Should Controllers Be Doing Now<\/em>?<\/strong><\/p>\n Opinion 22\/2024 is more than guidance-it is becoming an enforcement benchmark. At Allegiance Law, we recommend that all controllers, regardless of sector, take the following steps without delay (i) Audit and document your entire processor chain, (ii) verify guarantees and keep records of due diligence activities, (iii) update DPA templates to align with the EDPB\u2019s position on legal exceptions, (iv) mplement transfer mapping and risk assessments for all international data flows, (v) prepare for enforcement. Data protection authorities are expected to increase scrutiny, especially in high-risk or tech-driven processing environments.<\/p>\n