PRIV-26 Subprocessors Inventory

What is this control about?

Implementing the control “Subprocessors Inventory” is crucial for ensuring data security and compliance with data protection regulations. A subprocessor is a third-party vendor or service provider engaged by a data processor to handle personal data on behalf of the data controller. Subprocessor inventory control involves maintaining a comprehensive list of all subprocessors that have access to or process personal data on behalf of the organization.

Read our GRC Launchpad article: Who is a third-party vendor, a subprocessor and a third-party supplier? to learn more.

Available tools in the marketplace

Available templates

TrustCloud has a curated list of templates, either internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• Vendor Registrar template to track all vendors

Control implementation

Here are some guidelines to implement a Subprocessor Inventory:

1. Create a Subprocessors Register: Develop a centralized and comprehensive register to document all subprocessors engaged by the organization. The register should include essential details such as subprocessor names, contact information, location, data processing activities, and the type of personal data involved.
2. Assign Responsibility: Designate a responsible team or individual within the organization to manage the subprocessors register and update it regularly. This person or team will be responsible for tracking changes in subprocessors and ensuring the accuracy and completeness of the information.
3. Review Existing Contracts: Review all existing contracts with subprocessors to assess their compliance with data protection requirements. Ensure that appropriate data protection clauses, security measures, and data processing terms are included in the contracts.
4. Conduct Risk Assessments: Assess the risks associated with each subprocessor based on their data processing activities and the type of personal data involved. Consider factors such as data sensitivity, the volume of data processed, security measures, and geographical location.
5. Obtain Necessary Approvals: Obtain necessary approvals from relevant stakeholders, such as the Data Protection Officer (DPO) or legal department, for engaging new subprocessors or making changes to existing ones.
6. Monitor and Update: Regularly monitor the performance and compliance of subprocessors. Update the subprocessors register whenever there are changes in subprocessors or their data processing activities.
7. Implement Data Protection Agreements: Ensure that appropriate Data Protection Agreements (DPAs) are in place with all subprocessors. These agreements should outline the subprocessor’s responsibilities, data protection obligations, security measures, and requirements for data breaches and incident reporting.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide your Subprocessors register

Evidence example

For the suggested action, an example is provided below:

1. Provide your Subprocessors register
   The following screenshot shows an automated registrar in TrustCloud.
   Review the vendor page in TrustCloud to ensure that it is accurate and includes all vendors. Use the tagging functionality to identify your subprocessors.
   

Implementing the ‘Subprocessors Inventory’ control is essential for maintaining data security and ensuring compliance with data protection regulations. This control involves creating and managing a comprehensive register of all subprocessors who handle personal data on behalf of your organization.

Key steps include developing a centralized subprocessor register, assigning responsibility for its management, reviewing existing contracts for compliance, conducting risk assessments, obtaining necessary approvals, and continuously monitoring and updating the register.

Additionally, ensuring that data protection agreements (DPAs) are in place with all subprocessors is crucial. By following these guidelines, organizations can effectively mitigate risks, maintain compliance, and provide auditors with the necessary evidence, such as the subprocessor register, to demonstrate robust data protection practices. For more details and tools to get started, explore our curated templates and resources available through TrustCloud.