{"id":7390,"date":"2023-05-23T15:36:04","date_gmt":"2023-05-23T15:36:04","guid":{"rendered":"https:\/\/viqtor.eu\/?p=7390"},"modified":"2026-06-04T15:07:34","modified_gmt":"2026-06-04T15:07:34","slug":"comprendre-le-role-du-sous-traitant-selon-le-rgpd-responsabilites-et-implications","status":"publish","type":"post","link":"https:\/\/viqtor.eu\/en\/understanding-the-role-of-the-subcontractor-under-the-gdpr-responsibilities-and-implications\/","title":{"rendered":"Understanding the role of the subcontractor under the GDPR: Responsibilities and implications"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

GDPR Subcontractor: Why Evaluating Your Service Providers Has Become a Vital Issue for Your Business<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Outsourcing the processing of its data to a service provider never absolves the company of its responsibilities. Since 2021, the CNIL<\/strong> has increased sanctions against organizations that had not properly assessed or regulated their GDPR subcontractor<\/strong> \u20ac1 million against Mobius Solutions in December 2025, \u20ac1.5 million against Dedalus Biologie, \u20ac600,000 against Canal+ Group, \u20ac800,000 against Discord. The message is clear: outsource the processing of personal data<\/strong> is not delegating compliance.<\/p>\n

For managers, the issue has shifted from legal matters to risk management. Evaluating service providers, formalizing the GDPR subcontracting agreement<\/strong>Monitoring the chain over time: these are legal obligations whose non-compliance is costly.<\/p>\n

\n

<\/p>\n<\/div>\n

<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Understanding the role of the GDPR subcontractor and their obligations<\/h2>

Who is a subcontractor within the meaning of the GDPR?<\/h3>

The GDPR defines a data processor as any natural or legal person who processes personal data<\/strong> on behalf of data controller<\/strong>As soon as a service provider accesses, hosts, analyzes or stores personal data<\/strong> that you entrust to him, he is a subcontractor: cloud hosts, SaaS publishers, payroll providers, marketing agencies, call centers, CRM, email providers, IT maintenance companies.<\/p>

The border with the status of data controller<\/strong> is not always obvious. A service provider who decides on the purpose or means of data processing moves into a higher category and then bears full responsibility. This is precisely the trap into which Mobius Solutions Ltd fell, fined one million euros by the CNIL<\/strong> in December 2025 for reusing Deezer data to improve its own services, without any instruction from its client.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

The subcontractor's obligations as outlined in Article 28<\/h3>

Article 28 of the GDPR specifically lists the obligations of the subcontractor<\/strong> : act only on documented instructions, guarantee the confidentiality of authorized personnel, implement appropriate technical and organizational security measures, assist the data controller<\/strong> in managing individuals' rights and reporting violations, deleting or returning data at the end of the service, and maintaining a processing activities register<\/strong> specific to its activity.<\/p>

This last obligation is often overlooked. However, the CNIL (French Data Protection Authority) has cited it in several recent sanctions, including the Mobius Solutions case. Failing to keep a register means depriving oneself of the main proof of compliance in the event of an audit.<\/p>

Cascading subcontracting: prior authorization is mandatory<\/h3>

A subcontractor may only engage a subsequent subcontractor ("cascade") with prior written authorization, specific or general, from the data controller<\/strong>In the case of general authorization, the provider must inform the client of any changes to allow them to object. A SaaS provider that relies on a cloud hosting provider, which itself uses a monitoring sub-provider, must be able to document each link in the chain.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

The obligation to evaluate subcontractors: a duty too often neglected<\/h2>

An explicit and structuring obligation of the GDPR<\/h3>

Article 28, paragraph 1 of the GDPR is unambiguous: the data controller<\/strong> "Only uses subcontractors who offer sufficient guarantees." This is not a recommendation, it is a positive obligation. Before entering into a contract, the manager must ensure that their service provider has the skills, procedures, and organization to process data in accordance with the regulation.<\/p>

This implies a formalized evaluation procedure: criteria grid, compliance questionnaire, request for supporting documents (security policy, certifications, DPA<\/strong>, register, designation of a DPO<\/strong>), analysis of subsequent subcontractors, verification of server location and any potential data transfers<\/strong> outside the EU. This assessment must be tracked and kept \u2014 without it, the manager will not be able to demonstrate either his diligence or his compliance with the principle of accountability.<\/p>

CNIL sanctions that should alert managers<\/h3>

In 2024, the CNIL<\/strong> It issued 87 sanctions totaling over 55 million euros. Several recent cases show that evaluating and regulating its service providers has become a key area of control.<\/p>

The Dedalus Biologie case (April 2022, \u20ac1.5 million) remains emblematic. CNIL<\/strong> The French Competition Authority sanctioned this software publisher for medical laboratories following a massive data breach involving health information. Beyond the security flaw, the absence of mandatory clauses from Article 28 in its standard contracts was the primary reason given. This decision marked a turning point: a subcontractor can now be directly penalized for failing to properly formalize the relationship, regardless of the client's responsibility.<\/p>

The Mobius Solutions Ltd \/ Deezer case (December 2025, 1 million euros) illustrates the most frequent shortcomings: data retention beyond the end of the contract, processing outside of the client's instructions, lack of register, lack of security measures which led to the publication of the data of several million users on the darknet.<\/p>

The Discord case (2022, \u20ac800,000) is resulting in sanctions on the side of the data controller<\/strong> the absence of a contract compliant with Article 28. Canal+ Group, fined \u20ac600,000 in 2022, was penalized in particular for the lack of sufficient contractual agreements. As of January 27, 2021, the CNIL<\/strong> inaugurated his doctrine by simultaneously sanctioning a data controller<\/strong> (\u20ac150,000) and its subcontractor (\u20ac75,000) for failure to take measures against credential stuffing.<\/p>

What the CNIL examines in its audits<\/h3>

As decisions are made, the control grid of the CNIL<\/strong> The details have become clearer. The authority is verifying the existence of a GDPR subcontracting agreement<\/strong> written and compliant with Article 28, the documentation of instructions, the up-to-date list of subsequent subcontractors, the technical and organizational measures actually implemented, the notification procedures for a data breach<\/strong>, the arrangements for assisting individuals with their rights, the conditions for ending the contract and the traceability of audits carried out.<\/p>

To prepare your organization for these checkpoints, our A complete guide to GDPR compliance audits<\/a><\/strong> details the methodology to be applied.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Do you want to secure your subcontracting chain and demonstrate your compliance?\u00a0<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t<\/i>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\tTalk to a Viqtor\u00ae expert<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Building a solid contractual framework: the GDPR subcontracting agreement<\/h2>

The mandatory clauses of Article 28, paragraph 3<\/h3>

The DPA (Data Processing Agreement)<\/strong>, Or GDPR subcontracting agreement<\/strong>must include a core set of clauses mandated by the regulation: subject matter and duration of processing, nature and purpose, type of data and categories of persons, obligations and rights of the data controller<\/strong>It must also include eight specific commitments from the subcontractor: to act on documented instructions, to guarantee confidentiality, to take the required security measures, to engage subsequent subcontractors only with authorization, to help respond to requests from individuals, to assist in matters of security and notification, to return or delete data at the end of the contract, and to make available all the information necessary for audits.<\/p>

A publisher's standard terms and conditions are generally insufficient, such as the CNIL<\/strong> Dedalus and several other service providers, who have since been sanctioned, were criticized for this. A contract-by-contract review is essential.<\/p>

Pitfalls to avoid in writing<\/h3>

Several errors regularly undermine compliance. A clause totally exempting the subcontractor from liability is unenforceable against the CNIL<\/strong> as to the victim of a leak. A missing or outdated list of subsequent subcontractors exposes the data controller<\/strong> to a failure. Vaguely described security measures are insufficient: the CNIL<\/strong> awaits a concrete, verifiable, dated reference document. The absence of a violation notification procedure, or deadlines incompatible with the 72 hours imposed on the data controller<\/strong>, is systematically retained against defaulting subcontractors.<\/p>

The central role of the DPO and data governance<\/h3>

THE DPO<\/strong> The Data Protection Officer (DPO) plays a pivotal role: they lead the evaluation of service providers, validate contractual clauses, oversee the register of subcontractors, and alert management to risks. In the absence of DPO<\/strong>These missions must be carried out by a clearly identified function. data governance<\/a> largely relies on this ability to maintain the relationship with subcontractors over time.<\/p><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Managing the relationship over time: audits, monitoring and incidents<\/h2>

A continuing obligation, not a signature formality<\/h3>

Putting it in a contract is not enough. data controller<\/strong> must ensure over time that its service provider respects its commitments: periodic audits, annual review of the DPA<\/strong>, systematic update in case of change (new subsequent subcontractor, new scope, new server location).<\/p>

There CNIL<\/strong> is explicit: using a subcontractor never exempts the data controller<\/strong> of its duty of care. Canal+'s sanction was based precisely on the finding that effective oversight of service providers was not implemented. Conversely, a company capable of producing audit reports, completed questionnaires, and action plans demonstrates its diligence, even in the event of an incident.<\/p>

THE Viqtor Subcontractors Module<\/a> centralizes the evaluation, the contract, subsequent subcontractors, audits and the history of exchanges in a single repository.<\/p>

Responding to a data breach involving a service provider<\/h3>

A significant proportion of the violations reported each year to the CNIL<\/strong> involves a subcontractor. data controller<\/strong> Therefore, a rapid alert system must be included in the contract from the outset. The subcontractor is required to inform their client "as soon as possible," which in practice means 24 to 48 hours to allow for notification within the legal 72-hour period. CNIL<\/strong>Our page dedicated to the data breach statement<\/a> He details the steps.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

What you need to note<\/h2>