A vendor's public trust portal still lists outdated sub-processors while live support traffic already routes through new providers. Which practice best aligns with responsible processor obligations?
Select an answer to reveal the explanation.
Short Explanation
If the trust page says one set of helpers and production uses another, controllers are flying blind. Keep the sub-processor list honest and current—like a cast list that matches who's actually on stage. Outdated portals break the transparency processors owe.
Full Explanation
Processors that engage sub-processors must do so with appropriate controller authorisation and meaningful transparency about who processes personal data on their behalf. Keeping public trust-portal disclosures accurate and current enables controllers—especially municipalities—to understand and authorise onward processing chains. When the portal still lists outdated providers while live support traffic already routes through new ones, controllers cannot exercise informed oversight and authorisation becomes fictional.
Hiding all sub-processor identity forever overweights a cyber-obscurity argument and undercuts controller accountability for the processing chain. Updating disclosures only after a supervisory fine appears in the Official Journal is reactive non-compliance, not governance. Listing fictional EU entities while production uses other providers is deceptive and can mislead transfer and due-diligence analysis.
Exam caveat: trust-center marketing must match production reality on the exam and in audits. Operational check: synchronise portal lists with provisioning systems, notify controllers of material sub-processor changes under contract timelines, and verify data-flow diagrams against live routing. Cities relying on vendors for citizen support should insist on truthful sub-processor maps so municipal accountability does not stop at the first contractor’s brochure.