GDPR (General Data Protection Regulation)

How Does GDPR Hold a Company Liable for Its Vendors?

GDPR applies to any organization that processes EU residents' data, regardless of where that organization is headquartered, and its fines reach 20 million euros or 4% of global annual turnover, whichever is higher. The regulation has applied since May 2018 without a major overhaul, though that's about to change: the EU's Digital Omnibus package, proposed in November 2025, would amend several GDPR provisions for the first time since the law took effect, including how breach notifications and vendor data sharing work.

Controllers and Processors Share the Contract

GDPR splits responsibility between controllers, the organizations that decide why and how data gets processed, and processors, the vendors that process data on a controller's behalf, and Article 28 requires a written contract between them before any data changes hands. That contract has to spell out the processing's purpose, duration, and security measures, and it has to bind the processor strictly to instructions from the controller.

The controller's own exposure stays fully in place regardless. If a processor suffers a breach or processes data unlawfully, the controller that hired it can still face a fine, a regulatory investigation, and the reporting obligations that follow. A vendor's mistake becomes the hiring company's regulatory problem the moment personal data is involved.

Black Kite's 2026 European Cyber Risk Report put a real number on that exposure. A single breached HR software processor, serving roughly 80% of Sweden's municipalities, exposed the personal data of more than 1 million individuals. Every affected municipality was a controller that had done nothing wrong technically and still owned the fallout. 

Sub-Processors Extend the Liability Chain

The chain extends well past the first vendor. A processor can't bring in a sub-processor without the controller's authorization, and the processor stays liable for that sub-processor's compliance under Article 28(4). A controller that only reviews its direct vendor's contract can still be several links removed from where its data actually ends up.

What Is Changing Under the EU's Digital Omnibus Package?

The Digital Omnibus package, still under negotiation as of publication, would amend several GDPR provisions that touch vendor relationships, and none of it is in force yet. The proposal would amend Article 33 to extend the breach notification deadline from 72 to 96 hours, limit mandatory notification to breaches likely to result in a high risk, and route notifications through a single EU entry point set up under NIS2, replacing today’s practice of reporting the same incident separately under GDPR, NIS2, and other frameworks. It would also codify recent EU case law holding that pseudonymized data shared with a third party counts as personal data only when the receiving vendor has means reasonably likely to re-identify it.

The European Data Protection Board has pushed back on parts of the package, warning that simplification shouldn't come at the expense of the rights GDPR was built to protect. As of September 2026, neither the Council nor the European Parliament had adopted a negotiating position on the GDPR provisions, and no adoption date is set, so the current rules, and the current vendor obligations, remain what a company has to plan around today.

How Is GDPR Different From CCPA and NIS2?

GDPR, CCPA, and NIS2 all touch vendor obligations, but they regulate different things for different companies:

• GDPR is a data protection law covering personal data broadly, applying to any organization worldwide that processes EU residents' information.
• CCPA is a state consumer privacy law with a narrower geographic reach but its own separate vendor contract requirements.
• NIS2 is a cybersecurity directive, a different lane entirely from data protection law, requiring EU essential and important entities to secure their supply chains, personal data or not.

A vendor serving customers in California, the EU, and an EU-regulated critical sector could need to satisfy all three at once, with three different contract structures and three different regulators watching.

Where Does a Signed Data Processing Agreement Fall Short?

A Data Processing Agreement proves what a processor promised, and GDPR's 72-hour breach notification clock only starts once the controller becomes aware of the incident, which depends entirely on the processor telling them. That dependency has a real track record.

Black Kite's Third-Party Breach Report 2026 found that vendors take a median of 10 days just to detect a breach, and public disclosure of third-party incidents averaged 117 days in 2025, up from 76 days the year before, a gap Black Kite's breach, the fine, and the third-party angle analysis explores in more depth for GDPR specifically.

A controller relying only on a signed DPA and the processor's own notification is planning a data breach response around a timeline it doesn't control. The 72-hour clock is meaningless if the controller doesn't find out for months.

How Does Black Kite Support GDPR Vendor Oversight?

Black Kite maps a processor’s externally observable technical findings, and any documentation parsed by UniQuE™ Parser, to GDPR control items alongside other frameworks, adding evidence beyond a signed DPA alone. Compliance Rating runs that correlation automatically across a company's full vendor list at once.

Vendor risk monitoring adds continuous visibility between assessment cycles, catching the kind of exposure that would otherwise surface only when the processor finally reports it, and vendor compliance management keeps the resulting evidence organized for whenever a regulator comes asking. Due diligence work still starts with the contract, and it keeps going well past it.

See also: Free GDPR Compliance Checker