In which a sub-processor is engaged, a similar data security obligations within the contract in between the controller and processor has to be imposed around the sub-processor by way of contract or other “organisational steps.”[45] The processor will stay totally liable into the controller for performance with the sub-processor’s obligations. https://sites.google.com/view/gdpr-compliance-in-usa/