Notify the data controller of any changes in data processors.

CONTROL ID
12648

CONTROL TYPE
Communicate

CLASSIFICATION
Preventive

This Control directly supports the implied Control(s):

Establish, implement, and maintain a personal data accountability program., CC ID: 13432

There are no implementation support Controls.

The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, ther… (Art. 28.2., Regulation (EU) 2016/679 of The European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation))
The organization should, in the case of having general written authorization, inform the customer of any intended changes concerning the addition or replacement of subcontractors to process PII, thereby giving the customer the opportunity to object to such changes. (§ 8.5.8 Control, ISO/IEC 27701:2019, Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines)