How data processors can get you fined: vetting vendors and transfers under GDPR

The point: your vendors are part of your compliance

A small online shop in Cork runs on perhaps a dozen outside services. An email platform, a chat widget, a reviews tool, analytics, accounting, a courier app. Each of them touches customer data, and each of them is a legal relationship under the General Data Protection Regulation (GDPR). If one of them handles that data badly, the regulator does not stop at the vendor's door. It knocks on yours as well.

The law asks two things of you. First, before you hand personal data to a service provider, you choose one that can be trusted with it and you put a contract in place that says what it may do.¹ Second, if the data leaves the European Economic Area (EEA), you make sure the transfer has a legal route out and that the protection does not drop on the way.² The rules themselves date from 2018. What changed since is how hard the transfer half bites: the Court of Justice struck down the old EU US arrangement in 2020, and the Commission put a new one in place in 2023.³⁴

I go through both halves with the regulation and the guidance of the regulators, then show how I rank vendors so the review time goes where the risk is. The shop and its numbers are made up. The law is not.

Controller and processor: who decides and who does the work

Two words carry the whole subject. The controller is the business that decides why and how personal data is processed. The processor is the business that processes personal data on the controller's behalf.⁵ You are the controller of your customer list. The email platform that sends your newsletter to that list is your processor.

The test is who decides, not size or who owns the servers. A global software company is still your processor if it only does what you told it to do. The moment it uses the data for its own purposes, such as training its products or selling advertising, it acts as a controller for that part, and you need to know before you sign.

An example: Shandon Candle Company, an invented shop in Cork at shandoncandles.example, run by Aoife. She decides to send a monthly newsletter to customers who opted in, so she is the controller. The email platform stores the list and sends on her instruction, so it is her processor. Her chat widget stores transcripts for her staff, a processor too. But if its terms let it analyse those transcripts to improve its own models, it is deciding a purpose of its own. That is the sentence I look for first in any vendor's terms.

What Article 28 asks of you before you sign

Article 28 of the GDPR says you may use only processors that provide sufficient guarantees to implement appropriate technical and organisational measures.¹ The regulation's own recitals say those guarantees are judged in particular by the processor's expert knowledge, reliability and resources.⁶ The Data Protection Commission (DPC), the regulator here, sets out the same contract terms in its guidance, and reminds both sides that controllers and processors found in breach can each be fined.⁷

Then the contract. It must set out the subject matter, duration, nature and purpose of the processing, the types of data and people, and your rights and obligations, and it must oblige the processor to do eight things:¹⁷

1. Process the data only on your documented instructions, including on transfers abroad.
2. Make sure everyone handling the data is bound by confidentiality.
3. Take the security measures Article 32 requires.
4. Use another processor only with your authorisation, on the same terms.
5. Help you answer people who exercise their rights, such as access or erasure.
6. Help you with security, breach notification and impact assessments.
7. Delete or return all the data when the service ends, at your choice.
8. Give you the information needed to show compliance, and allow audits.

Most software vendors publish a data processing agreement meant to cover this list. Your job is not to write one. It is to check that it exists, applies to your plan, and says these eight things.

Worked example: checking the chat widget's agreement

Aoife's chat widget sends her a link to its data processing agreement. I read it against the list with her, one point at a time.

Instructions: the agreement says the provider processes data "to provide and improve the services". Improve is the provider's own purpose, so point one is only half met.

Confidentiality, security, help with rights and with breaches: a clause each, plus a security annex naming encryption and access controls. Points two, three, five and six pass.

Subprocessors: general authorisation, a public list, 30 days' notice of changes. Point four passes if Aoife subscribes to the notices.

Deletion within 90 days of the end of the contract, and a yearly audit summary on request. Points seven and eight pass.

Result: seven of eight met, one to fix. Aoife asks the vendor in writing how to opt out of "improvement" use. That one email is the due diligence for this point, and it is the one most shops never send.

Subprocessors: the vendors of your vendors

Your processor will almost always use processors of its own: hosting, email delivery, support tools. The law calls them other processors, and the industry says subprocessors. Article 28 says your processor must not engage one without your prior specific or general written authorisation, must tell you about changes so you can object, and must pass the same data protection obligations down to them by contract.¹ If a subprocessor fails, your processor stays fully liable to you.¹

An example: Aoife's accounting software lists four subprocessors on its website. Hosting in Ireland, email delivery in the United States, a support desk tool in the United States, and a payment provider in the UK. Two of the four send her customers' names and addresses to the United States. The sales page never mentions it. The subprocessor list does. Five minutes of reading changes which transfer questions she needs to ask.

Who pays when a processor gets it wrong

The old version of this article said that if your processor fails, you are the one on the hook. That is too simple.

On compensation to the people affected, Article 82 says any controller involved in processing is liable for the damage caused by processing that breaks the regulation. A processor is liable only where it did not meet the obligations aimed at processors, or acted outside or against your lawful instructions.⁸ Where both are responsible for the same damage, each can be held liable for the whole of it, so the person gets paid, and the one who paid can then claim back the other's share.⁸ A controller escapes only by proving it was not in any way responsible.⁸

On fines, the regulator can fine processors directly as well as controllers.⁷⁹ The best known fine in Ireland concerns transfers. In May 2023 the DPC fined Meta Platforms Ireland €1.2 billion and ordered it to suspend transfers of Facebook users' data to the United States. Meta had used the Commission's standard contractual clauses with supplementary measures of its own, and the DPC found that those arrangements did not address the risks the Court of Justice had identified in Schrems II.¹⁰ The paper was in place. The assessment behind it did not hold.

The fine levels are set in Article 83. Breaking the controller and processor obligations, Article 28 among them, carries a maximum of €10 million or 2% of worldwide annual turnover, whichever is higher. Breaking the transfer rules carries the higher maximum, €20 million or 4%.⁹

The old article also said the law does not distinguish deliberate from accidental failures. It does. When setting a fine, the regulator weighs the intentional or negligent character of the infringement, and the degree of responsibility, taking into account the technical and organisational measures put in place.⁹ That is the reason to keep a written record of your vendor checks.

An example: suppose Aoife's chat provider is breached and chat transcripts with delivery addresses leak. If Aoife read the agreement and fixed the one gap, her file shows it. If she pasted a script into her site and never looked, her file is empty. Same breach, very different position.

When data leaves the EEA: the three criteria

Chapter V of the GDPR opens with Article 44: any transfer of personal data to a third country takes place only if the conditions of the chapter are met, including for onward transfers, so that the level of protection the regulation guarantees is not undermined.² In practice that means an adequacy decision, appropriate safeguards, or an exception for specific situations.

For an Irish business a third country is anywhere outside the EEA. The old article asked whether data stayed "within the EEA", and for a shop in Cork that is the right question, with one change since 2021: the UK is now outside it, a third country with an adequacy decision of its own.¹¹

The GDPR does not define a transfer, so the European Data Protection Board (EDPB) set out three cumulative criteria. You are making a transfer, and Chapter V applies, if all three are met:¹²

1. Is the exporter, you or your processor, subject to the GDPR for this processing?
2. Does the exporter send the data, or otherwise make it available, to another controller or processor?
3. Is that importer in a third country?

Two details from the same guidelines catch most shops out. Making data available includes remote access, even if it only displays the data on a screen for support or troubleshooting, so a support team abroad that logs into your system is receiving a transfer, even though the servers never move. And when a processor in the EU passes data to its own subprocessor in a third country, that step is a transfer and Chapter V applies to it.¹² Your own employee opening the shop's files from a business trip to New York is not a transfer, because they belong to your own legal entity.¹²

Worked example: which of Aoife's vendors make a transfer

I take each vendor through the three questions.

The analytics tool is a British company hosting in London. The GDPR applies to Aoife, she sends it page view data, it is a separate company, and the UK is a third country. Three yeses: a transfer. The email platform is a US company: three yeses again.

The chat widget is an Irish company, but its support agents work for a contractor in India and log into the transcripts. For Aoife, question three is a no, because the chat company is in Ireland. For the chat company, all three are yes. The transfer exists, and it is the processor's to cover. Aoife checks that its agreement says how.

The courier app is Irish, with Irish hosting and nothing abroad. Question three is a no. Four vendors, three transfers, one made by her processor on her behalf. Had the analytics tool been a German company hosting in Frankfurt, it would not have been a transfer at all.

The routes out: adequacy, safeguards, exceptions

Every transfer needs one of three routes.²

Adequacy decisions come first. The European Commission decides which countries protect data adequately and keeps the list. It includes Switzerland, the United Kingdom, Japan, New Zealand, the Republic of Korea, Canada for commercial organisations and a handful of others. The United States is covered only for companies that take part in the EU US Data Privacy Framework.¹¹ The UK decisions date from June 2021 and were renewed by the Commission in December 2025.¹¹ With adequacy, data can flow without any further safeguard, and the EDPB says no further transfer assessment steps are needed, although you must keep an eye on whether the decision is revoked.¹¹¹³

Appropriate safeguards come second, under Article 46. For a small business the relevant one is the Commission's standard contractual clauses of 4 June 2021, adopted by Implementing Decision (EU) 2021/914.¹⁴¹⁵ Binding corporate rules, codes of conduct and certification exist too, but in my experience they are tools for corporate groups and sectors, not for a shop buying software.

Exceptions come last, under Article 49. They include the person's explicit consent after being told the risks, and transfers necessary for a contract with the person, such as delivering an order abroad.¹⁶ The EDPB is clear that they are for specific situations and cannot become the rule, so they are not a way to run a software stack.¹³

An example: Aoife's analytics tool in London is covered by the adequacy decision for the UK, so no safeguard and no transfer assessment are needed. Her email platform in the United States needs either the Data Privacy Framework or a safeguard. A customer in Galway who asks for a gift to be shipped to her sister in Australia triggers a transfer of name and address to a courier abroad, which is necessary for the contract with that customer. That one fits the contract exception. Three transfers, three different routes.

The transfer impact assessment, since Schrems II

Article 46 allows a transfer on appropriate safeguards only on condition that enforceable rights and effective legal remedies are available to the people concerned.¹⁴ In Schrems II, on 16 July 2020, the Court of Justice read that as requiring a level of protection essentially equivalent to the one guaranteed in the EU. The assessment has to cover both the clauses and, where public authorities in the destination can get at the data, the relevant parts of its legal system. If the clauses cannot be honoured there, the exporter has to suspend or end the transfer.³

The EDPB turned this into six steps: know your transfers, identify the transfer tool, assess whether the law and practice of the destination make that tool ineffective, adopt supplementary measures, take the procedural steps, and evaluate again at intervals.¹³ The practical exercise is usually called a transfer impact assessment, or TIA. You only need one when you rely on a safeguard: with an adequacy decision there are no further steps, and an exception is checked against its own strict conditions instead.¹³

The clauses build the assessment in. In Clause 14 both parties warrant that they have no reason to believe the laws and practices of the destination prevent the importer from complying. They declare they took account of the specific circumstances of the transfer, among them the purpose, the type of recipient, the categories and format of the data and the sector. They also agree to document the assessment and show it to the supervisory authority on request.¹⁵ The EDPB adds that documented practical experience of the importer can be taken into account.¹³ If the assessment shows the protection would fall short and no supplementary measure fixes it, you must not make that transfer on those clauses.¹³³

"The specific circumstances of the transfer" is the useful phrase for a small business: the effort scales with the data.

Worked example: a transfer impact assessment for the reviews tool

Aoife uses a reviews widget run by a small US company that is not on the Data Privacy Framework List. It receives each customer's first name, email address and order number, so it can send a review request after delivery. About 400 a month.

Step one, the safeguard: the Commission's standard contractual clauses, module two for a controller sending data to a processor, an Article 46 safeguard (more on that paper below).

Step two, the data: names, email addresses and order numbers. Nothing that reveals more than that someone bought a candle.

Step three, the destination: the usual question for the United States is access by public authorities. The Commission says the US safeguards behind the Data Privacy Framework apply to all transfers to US companies, whatever tool is used, which also helps when you rely on the clauses.¹⁷ This data is low in sensitivity and of little interest to anyone but the vendor.

Step four, extra protections: encryption at rest and in transit, deletion 12 months after the request.

Step five, the conclusion: given the specific circumstances, there is no reason to believe US law and practice stop the vendor honouring the clauses for this data. Aoife writes this on one page, dates it, and sets a review for next year. That page is the TIA, and Clause 14 is the reason to keep it. It took 20 minutes, about right for this data. Health data would take far longer.

The EU US Data Privacy Framework, and how to check it in two minutes

Since 10 July 2023 the Commission has had an adequacy decision for the United States, the EU US Data Privacy Framework.⁴ It covers a transfer only if the recipient is included in the Data Privacy Framework List, kept and published by the US Department of Commerce.⁴

The decision itself gives the checks.⁴ Find the company on the Data Privacy Framework List and confirm its status is active. If you are sending staff data, confirm that its certification covers human resources data, because each organisation declares which personal data its certification covers. Read the privacy policy linked from its entry. And check again from time to time, because participants must certify again every year and the list changes when one withdraws or is removed.⁴

If the company is not on the list, or its certification does not cover your data, you fall back on a safeguard, the standard contractual clauses, with a TIA. The framework itself has held so far: in September 2025 the General Court dismissed an action to annul it.¹⁸ Its two predecessors were struck down, so keeping the fallback in mind costs nothing.³

An example: Aoife's email platform is a US company. I search its name on the list at dataprivacyframework.gov. The entry shows an active status, participation in the EU US framework, and covers non human resources data. She sends no staff data. The framework covers the transfer, no TIA is needed, and the check is a screenshot dated today in her vendor file. If the entry had shown a lapsed certification, the framework would not apply, and she would need the vendor's standard contractual clauses and a TIA instead.

Standard contractual clauses: which module for which vendor

The Commission's clauses come as one set with four modules: controller to controller, controller to processor, processor to processor, and processor to controller.¹⁵ You pick the one that fits the relationship. For a shop sending customer data to a software vendor abroad, that is almost always module two. When your processor sends data on to its own subprocessor abroad, it uses module three.¹⁵

In practice the vendor supplies them, usually inside or alongside its data processing agreement. The rules on changing them are strict: the clauses must not be modified, except to select the module and fill in the appendix, and anything you add around them must not contradict them.¹⁵ The older clauses adopted under the previous directive were repealed, and contracts signed on them stopped counting as a safeguard after 27 December 2022.¹⁵

Two current points. The Commission is developing additional sets of clauses for importers outside the EU whose processing is directly subject to the GDPR.¹⁹ And the clauses do not replace the TIA. You need both: the paper, and the one page that says the protection holds.¹⁵

An example: when Aoife first asked, the reviews tool sent a set of clauses from 2010 still sitting on its website. Those have not been a valid safeguard since the end of 2022. She asks for the 2021 clauses, module two, the vendor sends them with the annexes completed, and she files them with her one page TIA. The old version of this article also suggested an EU based proxy as a fix. It is not a transfer route: it moves the data within the EU and does nothing for where the data goes next.

Ranking vendors by expected loss

A shop with a dozen vendors cannot give each a day's review, so I rank them by expected loss. For each vendor I estimate the probability of a data incident in the next year and its cost to the business, multiply, and add up.

$$E[L] = \sum_{i=1}^{n} p_i \, I_i$$

Here $E[L]$ is the expected loss for a year across all vendors, $n$ is the number of vendors, $i$ counts through them one by one, $p_i$ is the probability of an incident at vendor $i$ in that year, a number between 0 and 1, and $I_i$ is the cost to the business if that incident happens, in euro. The formula is the ordinary expected value, explained from scratch in Foundations: expected value.

The probabilities are judgement, not statistics. I set them from what I see: whether the agreement meets Article 28, whether the transfer route is in place, the sensitivity of the data, whether support staff abroad have access, and how the vendor handles security. The cost includes the hours to respond, notifying the DPC and customers where needed, lost orders and the customers who do not come back. The point is the ranking, not precision.

Worked example: the candle shop's five vendors

These are my own illustrative estimates for the invented shop, not industry figures. One line per vendor, probability times cost:

• Chat widget (addresses in transcripts, the "improvement" clause open, support abroad): $0.10 \times 15{,}000 = 1{,}500$
• Email platform (9,000 customers, active on the Data Privacy Framework List, good agreement): $0.03 \times 20{,}000 = 600$
• Reviews tool (no safeguard signed yet): $0.06 \times 8{,}000 = 480$
• Accounting (hosted in Ireland, US subprocessors on the framework): $0.01 \times 10{,}000 = 100$
• Analytics in London (page views, little personal data): $0.02 \times 3{,}000 = 60$

Adding the five lines gives the total, the same expected value sum as above (Foundations: expected value):

$$E[L] = 1{,}500 + 600 + 480 + 100 + 60 = 2{,}740$$

So $E[L]$, the expected yearly loss across the five vendors, is €2,740. The chat widget alone is more than half of it. That is where the first hour goes.

Each bar is one vendor, along the horizontal axis. The height is the expected yearly loss in euro, probability times cost, before any fixes. The takeaway is the shape: two vendors carry most of the risk, and two short pieces of work, the chat clause and the reviews safeguard with its TIA, cut the total from €2,740 to €1,370. After the fixes the chat widget drops to a probability of 0.03, so $0.03 \times 15{,}000 = 450$, and the reviews tool to 0.02, so $0.02 \times 8{,}000 = 160$. The email platform did not need anything and got nothing beyond its screenshot.

My review, step by step

I run this before a tool goes live, and again yearly or when the vendor sends a change notice.

The flow runs from the data to the paperwork. It starts with what the tool touches, because a tool that never sees personal data needs none of the rest. Every path ends in the same place: a dated record in the vendor file, the evidence of the measures you took.

An example: Aoife adds an Eircode lookup at checkout. It receives an Eircode and returns an address, and never sees a name or an email address. I note that in one line, check the vendor is in Ireland, and stop. Two minutes. The review is only long where the data is.

When a vendor fails the review

Sometimes a vendor will not sign an agreement, has no transfer route, or keeps a clause that lets it use your customers' data for its own purposes. In my experience there are three sensible responses.

Ask. Most vendors have the documents and simply do not advertise them. A short email asking for the data processing agreement, the subprocessor list and the transfer mechanism resolves more than half of the gaps I find.

Reduce what the tool sees. If a tool only needs an order number to do its job, do not send it the name and address. Less data lowers the probability and the cost in the formula at the same time, and it can turn a transfer that needs a long assessment into one that needs a short one.

Replace it. If the answers stay wrong, choose a vendor that gets them right. That is a decision, not a failure.

In my experience the tools most likely to fail are the ones added in a hurry by pasting a script into the site: chat widgets, session recording tools that can capture what people type into forms unless they are configured not to, and marketing tools that pass behaviour back to advertising platforms. The cookie side of those tools is a separate rule with its own consent requirements, which I cover in cookies, consent and tracking.

An example: the chat widget's vendor confirms by email that the "improvement" use can be switched off in the account settings for business customers. Aoife switches it off, saves the email and the screenshot, and asks the vendor to name the mechanism for its support contractor abroad. The answer is the standard contractual clauses, module three, signed between the vendor and its contractor. Two emails, one setting. The highest bar on the chart drops to a third.

Why this belongs in growth, not only in legal

The customer data in these tools is what a shop grows on: the email list, the order history, the reviews. A vendor that cannot delete a customer on request, or holds data somewhere you cannot account for, makes that data harder to use with confidence. When I design a shop's data flows, as in data warehousing for marketing automation, the vendor file is part of the design.

The work is small. A list of vendors, a few questions each, a screenshot or a page of reasoning where a transfer needs it, and a date to look again. Done properly, it is an afternoon. Left undone, it is an empty file on the day someone asks.

Footnotes

1. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 28 (processor), EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

2. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 44 (general principle for transfers) and Chapter V, EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

3. Court of Justice of the European Union, Press release 91/20, Judgment in Case C 311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, 16 July 2020, https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf

4. European Commission, Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU US Data Privacy Framework, Article 1 and recitals 48 to 52, EUR Lex, 2023, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023D1795

5. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4 (definitions), points 7 and 8, EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

6. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), recital 81, EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

7. Data Protection Commission, Controller and Processor relationships, in Know your obligations, DPC, https://www.dataprotection.ie/en/organisations/know-your-obligations/controller-and-processor-relationships

8. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 82 (right to compensation and liability), EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

9. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 83 (general conditions for imposing administrative fines), paragraphs 2, 4 and 5, EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

10. Data Protection Commission, Data Protection Commission announces conclusion of inquiry into Meta Ireland, DPC, 22 May 2023, https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland

11. European Commission, Adequacy decisions: how the EU determines if a country outside the EU has an adequate level of data protection, including the United Kingdom decisions as renewed in December 2025, European Commission, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

12. European Data Protection Board, Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR, version 2.0, paragraph 9, examples 7 and 8, EDPB, 14 February 2023, https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf

13. European Data Protection Board, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, version 2.0, EDPB, 18 June 2021, https://www.edpb.europa.eu/system/files/2021-06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf

14. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 46 (transfers subject to appropriate safeguards), EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

15. European Commission, Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries, Article 4 and Annex (Clauses 2 and 14), EUR Lex, 2021, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914

16. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 49 (derogations for specific situations), EUR Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

17. European Commission, EU US data transfers: how personal data transferred between the EU and US is protected, European Commission, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en

18. Court of Justice of the European Union, Press release 106/25, Judgment of the General Court in Case T 553/23 Latombe v Commission, 3 September 2025, https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf

19. European Commission, Standard contractual clauses (SCC), European Commission, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en