Key takeaway
A migration date is not an authorisation. Read the specific or general written-authorisation route and preserve the controller’s actual opportunity to object.
A technical replacement can introduce a different legal person
A service provider replaces the company that hosts a customer archive. The engineering team describes the move as routine maintenance, but the receiving legal person has changed. If the relationship is a processor chain, that change needs the relevant controller-authorisation and instruction review before the new processor is engaged.
EU GDPR Article 28 requires prior specific or general written authorisation for another processor. With general written authorisation, intended additions or replacements must be notified so the controller has an opportunity to object. The Commission’s controller-processor standard clauses illustrate separate options. Their advance-notice period is a field to specify, not a universal statutory number of days.
The fictional migration calendar has a hold
Hypothetical example: a controller’s fictional agreement uses general written authorisation and stipulates at least 14 calendar days’ advance notice of the listed-subprocessor change. That period is an invented contract term. Assume the notice procedure and relevant receipt date are being reviewed; this is not an actual notice or request to send one.
The processor’s plan identifies notice on day 0 and engagement of the replacement on day 5. Under those stipulated facts, the plan does not provide the entered 14-day interval. The completed change record therefore holds the day 5 engagement while the actual contractual and legal requirements are resolved.
| Change fact | Entered assumption | Illustrative decision |
|---|---|---|
| Authorisation model | General written authorisation for agreed list | Check actual scope and notice/objection procedure |
| Advance period | At least 14 calendar days in fictional agreement | Do not label this a GDPR-wide deadline |
| Proposed new engagement | Day 5 after assumed valid day 0 notice | Hold the proposed timing |
| Underlying purpose | Same instructed archive service assumed | Reopen roles if the recipient proposes its own use |
| Transfer/access location | Not yet resolved | Keep international-transfer review open |
Preserve what the controller needs to assess
The change record should identify the proposed legal entity, operation, affected data categories, locations and onward access, the relevant safeguards and the agreement’s authorisation route. A vendor brand and a migration-success ticket are too little information to evaluate the actual processing change.
Article 28 also addresses imposing the same data-protection obligations on another processor and the initial processor’s responsibility for its performance. The Commission’s model clauses set out associated information and agreement arrangements. Do not substitute a trust-centre badge for the actual relationship and obligations.
The hypothetical schedule does not declare that engagement becomes automatically permitted on day 14. That depends on the real authorisation, notice, objection, instruction and other applicable conditions. A team should resolve a recorded objection through the agreed process rather than silently converting an elapsed timer into approval.
Separate subprocessing from an independent recipient
The analysis starts from a scoped assumption that the new company processes on behalf of the controller. If it plans to retain the archive for its own product, the role and purpose questions have changed. The existing controller/processor guide should be used to examine that change; a subprocessor list cannot quietly license the new purpose.
International access and transfer questions also remain distinct. The controller-processor model clauses here are not, by themselves, a universal international-transfer mechanism. Keep location and access evidence alongside the role record and route the actual transfer issue for its own review.
For a company contemplating a separate data license, avoid importing this processor migration into the list of approved buyers. A service-chain authorisation concerns particular processing on behalf of the controller; it does not establish an independent permission to exploit or resell the records.
Close a defined change rather than a green migration ticket
The fictional record leaves three actions: correct the proposed timing, resolve the actual authorisation/objection process and complete the access-location assessment. Technical migration testing may proceed in an appropriately isolated environment, but it does not close those permission questions.
Use inventory to preserve the affected archive and processor identities and due diligence for the unresolved operation and access facts. A VOID introduction remains a separately authorised metadata handoff. The operational benefit is knowing which recipient may perform which instructed operation and when the actual change may occur.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.