CLAIM-2026-08-16-13
GDPR Article 28(2) provides that a processor shall not engage another processor without prior specific or general written authorisation of the controller, and Article 28(3)(a) binds processing to documented instructions including as to third-country transfers.
Why it matters
A routing pool is a set of sub-processors. Adding one is an authorisation event whether or not anyone treated it as one.
Sources
- intersoftco2026processor