For GDPR compliance, what documents or contracts need to contain a list of processors or sub-processors?
<p>Should a complete list of processors or sub-processors be written anywhere for GDPR compliance?
If so, who is required to do so? Controllers, processors, sub-processors?
And where should the list be written? Privacy policies, data processing agreements (DPAs), other documents?</p>

<p>Quoting article 28, paragraph 2, it seems sub-processors must be written in DPAs between a controller and a processor, but it's not clear to me whether the sub-processors list should be explicit or not:</p>

<blockquote>
  <p>The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.</p>
</blockquote>

<p>In all other cases I'm not sure whether any processors or sub-processors should be written anywhere. For example, I didn't find any information about listing processors in privacy policies. </p>

<p>I found a related question <a href="https://law.stackexchange.com/questions/17918/resellers-under-gdpr-disclosure-of-data-processors-or-countries-of-data-storag">here</a> about a specific case, but what I'm asking is more general.</p>

<p>Basically it goes like so:
Controller must specify all joint controllers, processors and sub processors. A controller may include this in their privacy policy but if that’s where the information is located consent must be obtained that the privacy policy was agreed to. Additionally the controller must record the privacy policy which was agreed to.</p>

<p>Processors must have DPAs with controllers specifying all their processors. They can place this in their privacy policy but must be consent at the time of DPA signing that the policy has been agreed to and record the specific policy that was agreed to.</p>

privacy european-union gdpr