A third party engaged by a processor to carry out specific processing activities on behalf of a controller.
A sub-processor is a vendor engaged by a data processor to perform processing activities on behalf of the original controller. Engaging or replacing a sub-processor requires the controller's prior specific or general written authorisation (GDPR Art. 28(2)).
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.