ISO 27701 | 8.5.8

Change of subcontractor to process PII

The organization should, in the case of having general written authorization, inform the customer of any intended changes concerning the addition or replacement of subcontractors... ... - Licensed content not shown -

GDPR (EU)

28.2: Article(28)(2): The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

LGPD (BRA)

Art.39: The processor must carry out the processing of the data in accordance with the instructions provided by the controller, which will verify the observance of these instructions and rules on the matter.

Personal Data Protection Act - Singapore

S.4.2: Except for Ss.24-25, no obligations apply to a 'data intermediary' in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a written contract

Personal Information Protection Act - South Korea

A.26: On outsourcing the processing of personal information to a third party, must satisfy certain formalities in writing and prevent processing for purposes other than the purposes for which the processing was outsourced and ensure technical and managerial safeguards