Processors, Vendors and International Data Transfers

Introduction

Modern organisations rarely collect, store, analyse, or transmit personal data entirely within their own systems. Cloud providers host databases, payroll companies process employee information, marketing platforms analyse customer behaviour, and software suppliers provide artificial-intelligence tools. These relationships create two related legal questions:

1. Who is responsible for personal-data processing?
2. Can the data lawfully be disclosed or transferred to another country?

Data-protection law generally places duties on both the organisation deciding why and how data is processed and the external organisation performing processing services. International transfers add a further layer of risk because the receiving jurisdiction may offer weaker privacy rights, broader government-access powers, or limited remedies for individuals.

This chapter develops a practical framework for vendor due diligence, data-processing agreements, liability allocation, and international-transfer mechanisms. It uses the terminology of the European Union General Data Protection Regulation (GDPR) as a widely influential model, while noting that national laws differ. Legal advice should be obtained for a particular transaction because transfer rules and enforcement practices change frequently.

Learning Objectives

By the end of this chapter, students should be able to:

• distinguish controllers, processors, joint controllers, vendors, and sub-processors;
• conduct proportionate due diligence before appointing a data-processing vendor;
• identify essential provisions in a data-processing agreement;
• evaluate contractual, operational, and regulatory allocation of liability;
• explain adequacy decisions, standard contractual clauses, binding corporate rules, and localisation requirements;
• recognise risks created by remote access, onward transfers, cloud services, and artificial-intelligence tools; and
• apply a structured decision process to an international transfer scenario.

1. The Organisational Roles in Data Processing

1.1 Controller

A controller is the person or organisation that determines the purposes and essential means of processing personal data. A university deciding to collect student information for enrolment, examinations, and communication will normally be a controller. The controller must identify a lawful basis, provide privacy information, respect individual rights, apply appropriate security, and demonstrate compliance.

The label used in a contract is not decisive. A business cannot avoid controller responsibilities simply by describing itself as a “customer,” “client,” or “data owner.” The actual decision-making relationship is more important than contractual terminology.

1.2 Processor

A processor processes personal data on behalf of a controller and generally acts on documented instructions. A payroll bureau, cloud-hosting provider, or outsourced call centre may be a processor. A processor does not become free from legal obligations merely because it follows instructions. It commonly must maintain security, assist with rights requests and incident response, control sub-processors, keep records, and notify the controller of a personal-data breach.

A processor may become a controller for a particular activity if it decides its own purposes. For example, a payment provider may process transaction data on behalf of a merchant but independently retain certain information to meet anti-money-laundering duties. The same organisation can therefore be a processor for one activity and a controller for another.

1.3 Joint controllers

Two organisations are joint controllers when they jointly determine the purposes and means of processing. Joint control does not necessarily require equal influence or identical responsibilities. The parties should transparently allocate responsibilities, especially for privacy notices and individual-rights requests, while recognising that individuals may retain rights against each controller.

1.4 Vendor and sub-processor

“Vendor” is a commercial term rather than a complete legal classification. A vendor may be a processor, controller, joint controller, or supplier that never handles personal data. A sub-processor is a separate processor appointed by the primary processor to process data for the controller. Examples include a cloud infrastructure provider used by a software-as-a-service vendor or an email delivery platform used by a customer-support provider.

The controller must be able to understand and govern the chain of processing. A long and opaque chain can make it difficult to identify where data is stored, who can access it, and which organisation must respond to an incident.

2. Vendor Due Diligence

Vendor due diligence is the structured assessment of whether a supplier can lawfully and securely process personal data. It should occur before procurement approval and continue throughout the relationship. The depth of assessment should be proportionate to the sensitivity, volume, duration, and risk of processing.

2.1 A risk-based assessment model

A practical assessment begins with five questions:

1. What data is involved? Consider identifiers, financial data, health information, biometric data, authentication credentials, children's data, and confidential business information.
2. Why is it processed? Confirm the purpose, lawful basis, retention period, and expected outputs.
3. Where is it processed? Map storage, support access, backups, disaster-recovery sites, and sub-processors.
4. Who can access it? Examine employees, contractors, administrators, privileged users, and government-access risks.
5. What happens if processing fails? Assess harm from loss, alteration, unauthorised disclosure, unavailability, or inaccurate processing.

A simple qualitative classification can place a vendor in low, medium, or high risk. High-risk vendors typically process special-category data, large datasets, children's information, identity documents, or data essential to safety or fundamental rights.

2.2 Evidence to request

Due diligence should test evidence rather than rely only on marketing claims. Relevant evidence may include:

• a description of processing activities and data flows;
• information-security policies and access-control procedures;
• independent audit reports or certifications, such as ISO/IEC 27001 or SOC 2, where relevant;
• penetration-test summaries and vulnerability-management processes;
• encryption practices for data in transit and at rest;
• incident-response and business-continuity plans;
• employee confidentiality and training arrangements;
• retention and secure-deletion procedures;
• the identity and location of sub-processors;
• procedures for responding to government or law-enforcement requests;
• privacy-impact or transfer-risk assessments; and
• insurance, financial stability, and regulatory history.

A certification is useful evidence but is not a complete legal assessment. A certificate may cover only a defined system, period, or control set. The organisation should verify scope, exclusions, expiry, and relevance to the proposed processing.

2.3 Contractual and operational questions

The assessment should ask whether the vendor can meet practical obligations. For example, can it search and export a particular person’s data within the required period? Can it delete backups? Can it distinguish one customer’s data from another’s? Can it notify the customer quickly enough to support regulatory reporting? Can it prevent support personnel in another country from viewing content?

Due diligence should also address concentration risk. If one supplier hosts critical systems for many business units, an outage or enforcement action may affect the entire organisation. Exit planning should test data portability, migration assistance, deletion certification, and continued access during termination.

3. Data-Processing Agreements

A data-processing agreement (DPA) translates legal requirements into operational commitments. Under GDPR Article 28, a processor contract must address matters including documented instructions, confidentiality, security, sub-processors, assistance with rights and compliance duties, return or deletion of data, and audits.

3.1 Essential DPA elements

A sound DPA should identify:

3.2 Instructions and purpose limitation

Instructions should be specific enough to prevent unauthorised repurposing. A clause permitting the vendor to use data “for service improvement and any other commercial purpose” may be inconsistent with purpose limitation unless carefully defined and supported by an independent legal basis. If the vendor wishes to use customer data to train a general artificial-intelligence model, the parties must separately analyse purpose, legal basis, transparency, confidentiality, intellectual property, retention, and controller status.

3.3 Security measures

Security clauses should describe outcomes and controls without becoming meaningless generalities. Measures may include least-privilege access, multi-factor authentication, network segregation, encryption, logging, secure development, patch management, resilience, backup protection, personnel screening, and tested incident response. The appropriate measures depend on risk; no single security catalogue is legally sufficient in every case.

3.4 Breach notification

The DPA should require the processor to notify the controller without undue delay after becoming aware of a personal-data breach. It should specify a communication channel, minimum information, continuing updates, preservation of evidence, and cooperation with investigation and notification. A clause that allows notification only after the vendor completes its investigation may prevent the controller from meeting its own legal deadlines.

3.5 Sub-processing

The controller should receive a current list of sub-processors, their locations, functions, and transfer mechanisms. General authorisation can be efficient, but it should be paired with advance notice of changes and a meaningful right to object. The primary processor remains responsible for ensuring that sub-processors are bound by equivalent data-protection obligations.

4. Allocating Liability and Accountability

Responsibility and financial liability are related but not identical. A controller may remain accountable to individuals and regulators even where a processor caused the immediate failure. A commercial indemnity may shift some financial costs between the parties, but it cannot remove statutory duties or prevent a regulator from investigating the controller.

4.1 Categories of liability

Important categories include:

• Regulatory liability: fines, enforcement notices, or corrective orders imposed by a supervisory authority.
• Civil liability: compensation owed to individuals or business partners.
• Contractual liability: failure to meet service levels, security promises, or audit commitments.
• Operational liability: costs of investigation, restoration, notification, legal advice, and remediation.
• Third-party liability: claims arising from sub-processors, customers, or affected persons.
• Reputational and strategic harm: loss of trust, business interruption, or exclusion from procurement.

4.2 Negotiating liability clauses

Parties commonly negotiate liability caps, exclusions for indirect loss, indemnities, insurance, and special treatment for confidentiality or data-protection breaches. A responsible analysis asks:

• Is the cap proportionate to the volume and sensitivity of data?
• Does it apply to all claims or exclude fraud, wilful misconduct, confidentiality breaches, or regulatory penalties where legally permissible?
• Are notification and forensic costs included?
• Does the indemnity cover claims caused by sub-processors?
• Is the vendor financially capable of paying?
• Does insurance cover cyber incidents, privacy claims, and cross-border litigation?

A clause cannot lawfully transfer a fine to an individual or eliminate rights granted by mandatory law. Contractual allocation should therefore complement, not replace, governance and security controls.

5. International Data Transfers

An international transfer may occur when data is sent to a recipient abroad, stored in another country, accessed remotely from another country, or made available to a foreign sub-processor. A transfer analysis should not focus only on the physical location of servers. Remote administrative access can create a transfer or equivalent regulatory concern even when primary storage remains in the original country.

The organisation should map the entire transfer chain:

Figure: A transfer map links data flows, legal mechanisms, safeguards, and individual remedies.

6. Main Transfer Mechanisms

6.1 Adequacy decisions

An adequacy decision is a formal finding that a destination country, territory, sector, or organisation provides an essentially equivalent level of protection. Where applicable, data may flow without requiring the exporter to use standard contractual clauses for that transfer. Adequacy is not necessarily permanent and may be limited in scope. Organisations should verify whether the decision covers the relevant recipient, data, and processing activity.

An adequacy decision does not excuse ordinary obligations such as transparency, security, purpose limitation, or lawful processing.

6.2 Standard contractual clauses

Standard contractual clauses (SCCs) are regulator-approved contractual terms for specified transfer relationships. Under the modern EU SCC framework, different modules apply to controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller transfers. The correct module, completed annexes, parties, technical measures, and onward-transfer provisions are essential.

SCCs are not a substitute for analysis. Following the Schrems II judgment, exporters and importers must consider whether the law and practice of the destination country may undermine the clauses, particularly through disproportionate public-authority access. Where necessary, supplementary measures may include strong encryption, pseudonymisation, access controls, transparency, and legal or organisational safeguards. The effectiveness of a measure depends on the circumstances; encryption may not protect data if the recipient must possess the decryption key.

6.3 Binding corporate rules

Binding corporate rules (BCRs) are internal privacy rules used by multinational groups for transfers among group entities. They require approval by a competent supervisory process and must be legally binding and enforceable for relevant individuals. BCRs can create a coherent global framework, but they require substantial governance, training, audit, complaint handling, and ongoing accountability. They do not automatically authorise transfers to unrelated vendors.

6.4 Derogations

Some laws recognise limited exceptions, such as explicit consent, necessity for a contract, important public interest, legal claims, or occasional transfers based on compelling legitimate interests. Derogations are generally interpreted narrowly and should not become a routine outsourcing mechanism. Consent must be informed, specific, and capable of withdrawal where the law requires it; employment contexts may make genuine consent difficult.

6.5 Localisation requirements

Data localisation requires data to be stored, processed, or made accessible within a specified jurisdiction. Some laws require local copies, local servers, restrictions on export, or government approval. Localisation may arise in financial services, telecommunications, health, government, or critical infrastructure regulation.

Localisation can reduce some transfer risks but does not automatically guarantee privacy or security. Data may still be accessed by foreign staff, transferred through support systems, or exposed to local misuse. Organisations must identify the exact requirement: storage localisation, processing localisation, access localisation, or a prohibition on export.

7. A Practical Transfer-Assessment Process

A useful process has seven stages:

1. Describe the transfer. Identify exporter, importer, data, individuals, purpose, frequency, storage, access, and onward recipients.
2. Classify the relationship. Determine controller, processor, joint-controller, or sub-processor status.
3. Select a legal mechanism. Check adequacy first, then consider approved clauses, BCRs, or a valid derogation.
4. Assess destination-country risks. Examine government-access laws, independent oversight, judicial remedies, and practical enforcement.
5. Select supplementary measures. Consider encryption, pseudonymisation, minimisation, split processing, local key control, and strict access restrictions.
6. Document the decision. Record assumptions, evidence, residual risks, approvals, and review dates.
7. Monitor and reassess. Revisit the assessment after legal changes, new sub-processors, incidents, or changes in processing.

8. Illustrative Case: GlobalCare Cloud Migration

Background

GlobalCare Clinics, a fictional regional healthcare network, plans to use a cloud-based appointment and patient-communications platform operated by CloudReach Ltd. CloudReach uses a support affiliate in a different country and an email-delivery sub-processor in a third country. The system will process names, contact details, appointment information, and limited clinical notes.

Problem

The procurement team assumes that selecting a reputable cloud provider solves the legal problem. However, the proposed arrangement involves health-related information, remote foreign support access, several sub-processors, and potentially different government-access rules.

Analysis

GlobalCare first identifies itself as controller and CloudReach as processor. CloudReach’s support affiliate and email provider are sub-processors unless they independently determine purposes. The data map shows that foreign access is possible even when the primary database is hosted locally.

The due-diligence team requests CloudReach’s sub-processor list, security audit, breach history, access-control design, deletion process, government-request policy, and transfer documentation. It discovers that support staff can access live records by default. This conflicts with the principle of least privilege.

Approach and solution

GlobalCare requires the following:

• clinical notes must be excluded unless demonstrably necessary;
• support access must be time-limited, logged, approved, and restricted to pseudonymised records where feasible;
• strong encryption must be used, with key management separated from the foreign support affiliate;
• the DPA must include detailed instructions, incident notification, rights assistance, deletion, audit, and sub-processor controls;
• an appropriate transfer mechanism must be executed for each relevant flow;
• a transfer-risk assessment must examine public-authority access and available remedies;
• the vendor must notify GlobalCare before adding a sub-processor and permit objection or termination where risk cannot be resolved; and
• an exit test must demonstrate export and deletion of patient data.

Outcome

GlobalCare approves the service only for limited appointment data during the first phase. Clinical notes remain in a locally controlled system. After six months, an audit confirms that foreign support access is rare, approved, and logged. The arrangement is reviewed when the vendor proposes a new artificial-intelligence analytics feature.

Learning points

The case demonstrates that transfer compliance is not achieved by a single contract or a server-location statement. It requires data minimisation, role classification, vendor evidence, technical controls, legal mechanisms, and continuous monitoring.

9. Technology, AI, and Emerging Risks

Cloud computing makes location dynamic: data may move among regions for resilience, load balancing, support, or analytics. Organisations should therefore ask for region controls and a current processing-location register. Zero-trust security, tokenisation, confidential computing, and customer-controlled encryption keys may reduce exposure, but they must be implemented correctly and tested.

Artificial-intelligence services create additional concerns. Prompts, uploaded documents, model outputs, logs, and feedback may contain personal data. A vendor may use such data for model training, retain it for abuse monitoring, or transfer it to another infrastructure provider. Contracts should specify whether data is used for training, how long prompts are retained, whether humans can review them, how deletion works, and whether the provider is acting as processor or controller.

Automated tools should not be treated as legal decision-makers. A transfer-risk assessment may be supported by software, but human professionals must validate the data map, legal mechanism, evidence, and residual risk.

10. Challenges and Limitations

Several practical difficulties recur:

• vendors may provide incomplete or rapidly changing sub-processor information;
• standard contracts may contain conflicting security, retention, and liability language;
• public-authority access laws are difficult to interpret and may change;
• localisation can increase cost and reduce resilience without eliminating remote access;
• small organisations may lack specialist legal and technical staff;
• audit rights may be limited by confidentiality and security concerns; and
• a transfer assessment can become obsolete after a new vendor, feature, country, or government practice is introduced.

The appropriate response is not to seek perfect certainty. It is to use a documented, proportionate, evidence-based process and to reduce residual risk to an acceptable and legally defensible level.

Best-Practice Checklist

Before approving a vendor or transfer, confirm that the organisation has:

• mapped data, access, storage, and onward transfers;
• classified each party’s legal role;
• assessed sensitivity, volume, and potential harm;
• completed evidence-based security and privacy due diligence;
• signed a suitable DPA with complete annexes;
• controlled sub-processors and changes;
• selected and documented an appropriate transfer mechanism;
• assessed destination-country law and practice;
• applied supplementary technical and organisational safeguards;
• tested rights support, breach response, export, and deletion;
• allocated liability without assuming contractual terms remove statutory duties; and
• scheduled monitoring and reassessment.

Chapter Summary

Controllers remain responsible for deciding why personal data is processed, while processors act on documented instructions and must provide security, assistance, confidentiality, and sub-processor controls. “Vendor” is a commercial label and does not determine legal status. Effective due diligence examines data sensitivity, processing locations, access, security evidence, sub-processors, government requests, resilience, and exit arrangements.

A data-processing agreement should define the subject and duration of processing, purpose, data categories, instructions, security, breach notification, rights assistance, audits, international transfers, and deletion. Liability clauses allocate financial risk but cannot eliminate regulatory duties or individual rights.

International transfers may involve storage, disclosure, or remote access. Adequacy decisions, standard contractual clauses, binding corporate rules, and limited derogations are important mechanisms, but each has conditions. Where contractual clauses are used, destination-country risks and supplementary measures must be assessed. Localisation may restrict storage, processing, access, or export, but does not automatically guarantee privacy.

The central professional skill is integrated governance: map the data, classify the roles, select the legal mechanism, apply technical safeguards, document decisions, and monitor the relationship over time.

Key Terms

Controller: Organisation that determines the purposes and essential means of processing.

Processor: Organisation that processes personal data on behalf of a controller.

Joint controller: Parties that jointly determine purposes and means of processing.

Vendor: Commercial supplier whose legal role depends on the actual processing relationship.

Sub-processor: Processor appointed by another processor to perform processing.

Data-processing agreement: Contract governing a processor’s processing for a controller.

Due diligence: Structured investigation of a vendor’s legal, operational, and security capability.

Personal-data breach: Security incident involving destruction, loss, alteration, unauthorised disclosure, or access to personal data.

Adequacy decision: Formal finding that a destination provides essentially equivalent data protection.

Standard contractual clauses: Approved contractual terms supporting specified international transfers.

Binding corporate rules: Approved internal privacy rules governing transfers within a corporate group.

Transfer-impact assessment: Analysis of transfer circumstances, destination risks, safeguards, and remedies.

Supplementary measures: Additional technical, contractual, or organisational safeguards.

Data localisation: Requirement to store, process, access, or retain data within a jurisdiction.

Purpose limitation: Requirement to use data for specified and legitimate purposes.

Data minimisation: Limiting data to what is necessary for the purpose.

Pseudonymisation: Processing that reduces direct identification while permitting controlled re-identification.

Liability cap: Contractual limit on the amount recoverable for specified claims.

Residual risk: Risk remaining after safeguards have been applied.

Review Questions

Short Answer Questions

1. Distinguish a controller from a processor.
2. Why is a vendor’s contractual label not decisive in determining its legal role?
3. List four matters that should be addressed in a data-processing agreement.
4. What is an adequacy decision?
5. Why can remote support access constitute an international-transfer concern?

Long Answer Questions

1. Explain the stages of a proportionate vendor due-diligence process.
2. Discuss how a data-processing agreement should regulate sub-processors and personal-data breaches.
3. Compare adequacy decisions, standard contractual clauses, and binding corporate rules.
4. Explain why contractual liability allocation does not remove a controller’s regulatory accountability.
5. Discuss the relationship between data localisation, security, and international-transfer compliance.

Analytical / Application Questions

1. A software provider stores data locally but permits administrators in another country to access live records. Identify the legal and operational issues that should be assessed before approval.
2. A vendor proposes to use customer records to train a general artificial-intelligence model. Analyse the questions concerning purpose, legal role, transparency, security, retention, and contractual control.
3. Design a transfer-governance plan for a healthcare organisation using a cloud processor, two foreign sub-processors, and a disaster-recovery site in a third country.

Multiple Choice Questions with Answers

Question 1

Which party generally determines the purposes and essential means of processing personal data?

A. The controller

B. The sub-processor

C. The auditor

D. The data subject

Correct Answer: A. The controller

Question 2

Which item is most directly relevant to vendor due diligence?

A. The vendor’s office decoration policy

B. The vendor’s incident-response and access-control procedures

C. The vendor’s preferred marketing slogan

D. The vendor’s employee vacation schedule

Correct Answer: B. The vendor’s incident-response and access-control procedures

Question 3

What is the primary function of a data-processing agreement?

A. To transfer ownership of all personal data to the processor

B. To define and govern processing performed for the controller

C. To remove all statutory duties from the controller

D. To guarantee that no security incident can occur

Correct Answer: B. To define and govern processing performed for the controller

Question 4

Which mechanism is a formal finding that a destination jurisdiction provides essentially equivalent protection?

A. A liability cap

B. A penetration test

C. An adequacy decision

D. A deletion certificate

Correct Answer: C. An adequacy decision

Question 5

What is a sub-processor?

A. An individual exercising a data right

B. A processor appointed by another processor

C. A regulator approving a transfer

D. A controller’s internal privacy officer

Correct Answer: B. A processor appointed by another processor

Question 6

Why may standard contractual clauses require additional assessment?

A. Because they never contain any contractual obligations

B. Because destination-country law may undermine their effectiveness

C. Because they apply only to paper records

D. Because they automatically prohibit every international transfer

Correct Answer: B. Because destination-country law may undermine their effectiveness

Question 7

Which statement about data localisation is most accurate?

A. It always guarantees strong privacy protection

B. It may concern storage, processing, access, or export, depending on the law

C. It eliminates the need for security controls

D. It is identical in every jurisdiction

Correct Answer: B. It may concern storage, processing, access, or export, depending on the law

Question 8

Which safeguard most directly reflects the principle of least privilege?

A. Giving all support staff permanent administrator access

B. Allowing only authorised personnel limited access needed for a task

C. Publishing customer records internally

D. Disabling all audit logs

Correct Answer: B. Allowing only authorised personnel limited access needed for a task

Question 9

A contractual liability cap primarily addresses which issue?

A. The maximum financial exposure for specified claims

B. Whether data is personal data

C. Whether a country has an adequacy decision

D. The identity of every data subject

Correct Answer: A. The maximum financial exposure for specified claims

Question 10

Which event should normally trigger reassessment of an international-transfer analysis?

A. A change in the vendor’s office furniture

B. The appointment of a new foreign sub-processor

C. A routine internal meeting with no processing impact

D. The publication of an unrelated advertisement

Correct Answer: B. The appointment of a new foreign sub-processor