Controllers, processors and subprocessors in chains

Ruth Boardman wrote an insightful article for the International Association of Privacy Professionals (IAPP) covering the European Data Protection Board's Opinion 22/2024 which addresses key obligations in controller-processor-sub processor relationships under GDPR. It clarifies requirements for processors to disclose sub-processor details to controllers, controllers' duties to verify GDPR compliance throughout the chain, and contractual language allowing processors to follow controller instructions or applicable laws. 

To delve into the full article click here.