> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pensionsportal.ie/llms.txt
> Use this file to discover all available pages before exploring further.
# Vendor & Sub-Processor Register
> PensionsPortal.ie's sub-processor register, management approach, and guidance for trustee clients maintaining their own Article 28 processor documentation.
import { Warning, Note, CardGroup, Card, Steps, Accordion } from '@mintlify/components';
# Vendor and Sub-Processor Register
Under GDPR Article 28, a data controller may only engage a processor that provides **sufficient guarantees** that it will implement appropriate technical and organisational measures to meet GDPR requirements and protect data subject rights. This obligation flows downstream: PensionsPortal.ie, as a processor to trustee clients, must provide those guarantees — and must ensure that any sub-processors it engages provide equivalent guarantees in turn.
This page documents PensionsPortal.ie's approach to sub-processor management, the categories of sub-processors currently used, trustee obligations regarding their own processor documentation, and the process for sub-processor change notifications.
***
## Legal Framework
**GDPR Article 28(2):** A processor shall not engage another processor (a sub-processor) without the prior **specific or general written authorisation** of the controller. Where general authorisation is used, the processor must inform the controller of any intended changes, giving the controller the opportunity to object.
**GDPR Article 28(4):** Where a processor engages a sub-processor, the same data protection obligations as set out in the contract with the controller shall be imposed on the sub-processor by way of contract. If the sub-processor fails to fulfil its data protection obligations, the processor remains fully liable to the controller.
**What this means for trustee clients:**
* Trustees must authorise PensionsPortal.ie's use of sub-processors. This authorisation is provided through the Data Processing Agreement (DPA) executed at onboarding, which grants general authorisation subject to the notification obligations described below.
* Trustees should include PensionsPortal.ie in their own processor register (maintained under their trust deed and GDPR documentation).
* The DPA imposes on PensionsPortal.ie the obligation to flow down Article 28 requirements to all sub-processors.
***
## How PensionsPortal.ie Manages the Sub-Processor Register
### Register Maintenance
PensionsPortal.ie maintains a current, versioned sub-processor register. The register is reviewed:
* On any change to sub-processor arrangements (addition, replacement, or removal)
* Quarterly as part of internal compliance review
* Annually as part of the full information security review cycle
The register records for each sub-processor:
* Legal name and registered address
* Category of service provided
* Data categories processed
* Processing locations (country/region)
* Transfer mechanism for EEA transfers (SCCs, adequacy decision, or intra-group agreement)
* Data Processing Agreement or equivalent contractual documentation in place
### Sub-Processor Due Diligence
Before engaging any sub-processor, PensionsPortal.ie conducts due diligence including:
* Review of the sub-processor's data protection and information security policies
* Verification of ISO 27001 certification or equivalent (where applicable)
* Review of the sub-processor's own sub-processor arrangements
* Assessment of any international transfer risks and available safeguards
### Contractual Requirements
All sub-processors are engaged under contracts that include, at minimum:
* GDPR Article 28(3) mandatory clauses (instructions, confidentiality, security, sub-processor restrictions, data subject rights assistance, deletion/return, audit rights)
* Standard Contractual Clauses (SCCs — Commission Implementing Decision 2021/914) where processing involves international transfers outside the EEA
* Incident notification obligations no less stringent than PensionsPortal.ie's own obligations to trustee clients
***
## Current Sub-Processor Categories
PensionsPortal.ie uses the following categories of sub-processors. This register is maintained as a live document; clients receive 30 days' advance notice of material changes. Specific vendor details are provided in the current version of the DPA schedule, available on request.
| Category | Purpose | Processing Location | Transfer Mechanism |
| ----------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------- |
| **Cloud Infrastructure** | Application hosting, compute, database services, storage | EU/EEA (primary); documented fallback regions | SCCs / adequacy where applicable |
| **Authentication & Identity** | User authentication, MFA, session management | EU/EEA | N/A (EEA processing) |
| **AI / LLM Services** | AI-assisted document drafting, compliance analysis, data quality alerting | EU/EEA preferred; SCCs in place for US-based providers | SCCs (Module 2 — controller to processor) |
| **Application Monitoring** | Error tracking, performance monitoring, log aggregation | EU/EEA | N/A (EEA processing) |
| **Document Storage** | Secure document vault, version control, scheme document repository | EU/EEA | N/A (EEA processing) |
| **Email / Communications** | System-generated notifications, rights request correspondence | EU/EEA | N/A (EEA processing) |
| **Payment Processing** | Subscription billing (no member personal data processed) | EU/EEA | N/A (EEA processing) |
No member personal data (member identifiers, salary, benefit, or contribution data) is transmitted to AI/LLM sub-processors for model training purposes. AI processing is subject to strict data minimisation — only data necessary for the specific AI function in context is transmitted, and transmission is subject to confidentiality obligations in the sub-processor contract.
***
## Sub-Processor Change Notification
PensionsPortal.ie provides **30 days' advance written notice** of any intended changes to sub-processor arrangements. This notice is issued to the designated compliance contact at each trustee client.
**Notice includes:**
* Name and description of the new, replaced, or removed sub-processor
* Nature of the change (addition, replacement, or removal)
* Categories of data affected
* Processing location and transfer mechanism (for new or replacement sub-processors)
* Effective date of the change
**Trustee right to object:**
Within the 30-day notice period, trustees may raise a written objection if they have legitimate grounds to believe the new sub-processor arrangement does not provide sufficient guarantees under Article 28. PensionsPortal.ie will engage in good faith to resolve the objection. Where the objection cannot be resolved, either party may terminate the DPA without penalty in respect of the affected processing.
Where a trustee client does not respond within the 30-day notice period, the sub-processor change will be deemed accepted for the purposes of the DPA. Trustees should ensure that sub-processor change notifications are routed to an active compliance inbox monitored by the DPO or responsible trustee.
***
## What Trustee Clients Must Do
Trustees, as data controllers, have their own Article 28 obligations. PensionsPortal.ie's sub-processor register satisfies PensionsPortal.ie's processor obligations — but trustees must maintain their own documentation:
Trustees' own Article 30 RoPA and processor register should list PensionsPortal.ie as a processor. The DPA executed at onboarding provides the contractual basis. Details: categories of data processed, processing purposes, retention arrangements.
The Data Processing Agreement is a mandatory Article 28 document. Trustees should retain a signed copy in their scheme governance files. The DPA should be reviewed when the scheme undergoes material change or when PensionsPortal.ie notifies a significant update.
Trustees' DPIA and RoPA should record that general authorisation has been granted for PensionsPortal.ie's sub-processor use, subject to the 30-day notification mechanism. The basis for this authorisation and the notification mechanism should be documented.
Member-facing privacy notices should describe the categories of third parties (processors and sub-processors) to whom member data is disclosed and the purpose. Specific vendor names are not required — category descriptions are sufficient for Article 13/14 compliance.
***
## International Transfers and SCCs
Where sub-processors operate outside the EEA, GDPR Chapter V requires that an appropriate transfer mechanism is in place. PensionsPortal.ie uses:
**Standard Contractual Clauses (SCCs):** Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (controller to processor) for transfers from PensionsPortal.ie (as processor for trustees) to sub-processors outside the EEA. The SCCs impose data protection obligations on the sub-processor equivalent to those under EU GDPR.
**Transfer Impact Assessments (TIAs):** For transfers to countries without an EU adequacy decision (e.g. United States under most circumstances), PensionsPortal.ie conducts a Transfer Impact Assessment evaluating the legal framework in the destination country and the risk of government access to transferred data. TIAs are documented and reviewed annually.
Following the *Schrems II* judgment (C-311/18, 16 July 2020) and the EDPB's supplementary transfer guidelines, reliance on SCCs alone is insufficient where there is a risk of access by third-country authorities inconsistent with EU fundamental rights standards. PensionsPortal.ie's TIAs address this requirement. Trustee clients may request a copy of the relevant TIA for their DPA files.
***
## Requesting the Sub-Processor Register
The current, specific sub-processor register (including named vendors) is available to trustee clients under the terms of the DPA. To request a copy:
* Contact your PensionsPortal.ie account manager
* Raise a support ticket referencing "Sub-Processor Register Request"
* Direct your DPO to the compliance portal within the platform
The register will be provided within 5 business days. Updates to the register are notified proactively via the 30-day change notification mechanism described above.