A processor subcontracts hosting of the controller’s personal data to another provider without informing the controller or obtaining the required authorisation. Which GDPR theme is primarily violated?
Select an answer to reveal the explanation.
Short Explanation
The processor cannot quietly pass your data to a new host like a hot potato. Controllers must authorise sub-processors—specifically or generally—and get transparency when the chain changes. Price tags do not skip that rule.
Full Explanation
Processors must not engage another processor without prior specific or general written authorisation of the controller, with transparency obligations under Article 28. Subcontracting hosting of the controller’s personal data without informing the controller or obtaining required authorisation primarily violates that processor-chain control theme. Processors may not freely appoint any sub-processor because hosting is never processing—hosting personal data is processing. Cheaper storage rates do not waive authorisation. Only data subjects need not approve sub-processors while controllers have no say—the controller’s authorisation is central. Exam caveat: prior authorisation + transparency for sub-processors is a frequent Article 28 test. Operational check: inventory sub-processors in civic DPAs, require notice of changes with objection rights under general authorisation, and flow down equivalent data-protection obligations. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.