Track processors and transfers outside the Union

A processor handles personal data on your behalf: hosting provider, email service, payroll software vendor, outsourced support… The GDPR requires a contract that governs it (Article 28) and a safeguard for any transfer of data outside the Union (Chapter V). The Data protection › Processors screen keeps all of this in one place, for each legal entity.

Who does what

A processor's record

• Processing entrusted and data entrusted (the same categories as the register).
• Processing countries: the two-letter ISO codes of the countries where the data is processed or accessible (FR, IE, US…).
• Sub-processor of: a provider of your processor (its support, its hosting provider). It is shown under its name in the list.
• Register activities entrusted: tick the register activities this processor carries out for you.
• Links to the contract and the supplier: the address of their record in the application, so the contract and the supplier are not copied.

The processing agreement

Enter the reference, the signature date and the end date, then attach the signed agreement. Then tick each mandatory Article 28(3) clause you have checked in the agreement: documented instructions, confidentiality, security, sub-processors, assistance with data subject rights, assistance with obligations, deletion or return of the data at the end of the contract, audits.

Also enter the date of the last audit and the review frequency. After each review, click Review done: the next due date is recalculated.

Transfers outside the Union

For each country outside the Union where the processor transfers the data or gives access to it, add a transfer:

1. The country and the recipient (parent company, support center…).
2. The safeguard: adequacy decision, standard contractual clauses, binding corporate rules, Article 49(1) derogation (then choose its point), or another safeguard that you describe.
3. For standard clauses or binding corporate rules, the date and conclusion of the transfer impact assessment, and the supplementary measures (encryption, pseudonymization…).

Alerts

The list flags each processor to be fixed: missing or expired agreement, clauses not all checked, overdue review, transfer without safeguard, transfer without impact assessment. Tick With an alert to see only those. The data protection officers receive a message every morning when new alerts appear; the same alert is reported only once.

When the relationship ends, click End the relationship: the record can still be read (tick Ended relationships) but no longer raises alerts.

With data subject requests

When a person has their data rectified, erased or restricted, the "notify the recipients" task of each activity concerned names the processors linked to it: you know whom to notify.

When you are a processor yourself

If your organization processes data for its customers (online software, managed services…), open Our customers (processing agreements) from the processor list:

1. On the record of each provider concerned, tick Listed in the sub-processor list published to our customers.
2. Publish the list with a notice period (30 days for example) and a sentence that sums up the change: your active customers receive an email in their language, and the new version only applies on the announced date. The public page shows the current version and the upcoming one.
3. For each customer, generate the processing agreement as a PDF in their language, then record their acceptance with the signed copy: the date, the signatory and the file fingerprint are kept.
4. If a customer objects to a change, record their objection and its reason; withdraw it once the matter is settled.