When your CRM provider gets hacked, you notify the ICO — not them. When your email platform leaks subscriber data, you face the Article 83 fine — not them. GDPR makes you, the data controller, legally responsible for what your processors do with personal data. Managing that liability starts with knowing which vendors touch personal data, having a DPA with every one of them, and tracking it all in one place.
GDPR created a legal structure that most SMBs are not fully aware of. Understanding it is the first step to managing it.
You decide WHY personal data is processed (controller). Your CRM, payroll provider, and email platform process it on your instructions (processors). GDPR creates separate obligations for each role — but most of the liability sits with the controller. If a processor misuses data, the controller is still accountable to the data subject and the regulator.
Article 83 fines (up to €10 million or 2% of global turnover for Article 28 violations) apply to the controller even when the breach or violation originated at the processor. The ICO’s enforcement actions have repeatedly held data controllers responsible for inadequate processor oversight — missing DPAs, no due diligence, no audit rights exercised.
Under Article 33(2), a processor must notify the controller “without undue delay” after becoming aware of a breach. But your obligation to notify your supervisory authority within 72 hours starts from when YOU become aware. If your DPA does not contractually require prompt notification, you may find out days later — and still face enforcement for a late ICO report.
Your CRM provider uses AWS. Your email platform uses a third-party deliverability tool. These are sub-processors — vendors your processor engages to help deliver the service. Article 28(2) requires your processor to get your prior written consent before engaging a sub-processor. If they change sub-processors without notice, they are in breach of their DPA — and you may be unaware of data flows you are responsible for.
These are not optional best practices. Each is a legal requirement with its own enforcement track record. Most SMBs have partial compliance on all four — and full compliance on none.
You must have a written DPA in place with every processor before they handle any personal data. The DPA must specify: the subject matter, duration, nature and purpose of processing, the type of personal data, the categories of data subjects, and your instructions to the processor. No DPA = direct Article 83 exposure. The ICO’s enforcement record shows this is actively investigated during audits.
Article 30 requires you to maintain a Record of Processing Activities (ROPA) that documents every processing activity — including which processors and sub-processors are involved. Your sub-processor register is a subset of your ROPA: a list of every vendor that processes personal data, what data they process, the legal basis, the retention period, and whether data is transferred outside the UK/EEA. Regulators can request this at any time. Having it in a spreadsheet is better than nothing; having it in a maintained, dated system is evidence of an active compliance programme.
If a vendor is based in, or processes data in, a country outside the UK or EEA, a transfer safeguard must be in place. For US vendors: check whether they hold EU-US Data Privacy Framework (DPF) certification at dataprivacyframework.gov. If not, Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) are required. For other third countries: check for an adequacy decision. Your sub-processor register must document the transfer mechanism for every out-of-jurisdiction vendor.
Your DPA must contractually require processors to notify you of a personal data breach without undue delay. Without this clause, you are dependent on the processor’s goodwill and internal processes. When a breach occurs at a processor, your 72-hour clock to notify the ICO begins when you become aware — not when the processor gets around to telling you. Proactive DPA management and a clear breach notification clause are the operational controls that make Article 33 manageable.
Article 28(3) specifies exactly what a DPA must contain. Many vendor-provided DPAs (in privacy policies or terms of service) omit required elements. Use this checklist when reviewing or requesting a DPA from any processor.
The processor must only process personal data on your written instructions. The DPA must state this explicitly and include a mechanism for issuing new instructions.
Everyone at the processor who handles personal data must be under a contractual or statutory obligation of confidentiality. The DPA must confirm this is in place.
The DPA must require the processor to implement Article 32 security measures: encryption, pseudonymisation, resilience, and a process for testing those measures. A reference to “industry standard security” alone is insufficient.
The processor must get your prior written consent before engaging a new sub-processor, and must flow down equivalent data protection obligations. The DPA should list current sub-processors and require notification of changes.
The processor must help you fulfil data subject access requests, erasure requests, and other Article 15–22 rights within the timeframe GDPR requires (typically one month).
The processor must assist you in meeting Article 32 (security), Article 33 (breach notification to supervisory authority), and Article 34 (communication to data subjects) obligations.
At the end of the contract, the processor must delete or return all personal data (at your choice) and confirm in writing that deletion is complete. Retention of data after contract end without a legal basis is a breach.
The processor must make available all information necessary to demonstrate compliance and must allow for and contribute to audits conducted by you or your auditor. A right to audit that is buried in terms-of-service language is not the same as a working audit right.
VendorAuditly gives you the operational infrastructure to stay compliant with GDPR’s vendor requirements — without a legal team or a €50k GRC platform.
A live, maintained register of every vendor that processes personal data — with data category, legal basis, processing location, and transfer mechanism recorded per vendor. Export your ROPA-ready sub-processor list for ICO requests or customer due diligence in one click.
Upload and track your DPA for every vendor. See at a glance which processors have a signed DPA in place, which are missing one, and which DPAs are due for review. Expiry alerts before a DPA lapses. No more “I think we have one somewhere” conversations during an audit.
Record the transfer mechanism for every vendor outside the UK/EEA — DPF certification, SCCs, IDTA, or adequacy decision. Track DPF certification status and SCC version (2021 EU SCCs vs older formats). Produces a transfer impact summary on demand.
Send GDPR questionnaires to vendors that include breach notification clause verification. Log incident history per vendor. Know which processors have agreed to notify you within 24 hours and which only commit to “without undue delay.” Evidence of active oversight is your best defence when a breach occurs.
Before approving a new processor, send them a GDPR due diligence questionnaire: do they have a DPA template? What security certifications do they hold? Where is data processed? What sub-processors do they engage? Document the answers before the contract is signed — not after a breach.
GDPR vendor obligations overlap with DORA Article 28, NIS2 Article 21, and ISO 27001 Annex A 5.19–5.23. VendorAuditly maintains one vendor register and exports evidence mapped to whichever framework your auditor or customer requires. No double data entry.
Import your vendors, attach your DPAs, log transfer mechanisms, and export a ROPA-ready register — without a legal team or a €50k compliance platform.
Start free — no credit card required →From $49/month · GDPR · DORA · NIS2 · ISO 27001 evidence export