What it asks for. Controllers may only use processors that provide sufficient guarantees of appropriate technical and organisational measures. Processing must be governed by a contract or other legal act that sets out the subject matter, duration, nature and purpose of processing and includes specified obligations, such as acting only on documented instructions, confidentiality, security, controls on sub-processors, assistance to the controller, deletion or return of data and audit support.
In practice. Organisations assess vendors before engagement, sign data processing agreements that cover the required terms and keep a register of processors and sub-processors. Evidence includes due diligence records, signed agreements, sub-processor change notifications and the results of audits or reviews of certifications and reports.
Common gaps. Due diligence is often done at onboarding and not repeated. Sub-processor chains are poorly tracked, and audit rights exist on paper but are never exercised.