Wherever a sub-processor is engaged, the identical information protection obligations in the deal between the controller and processor should be imposed around the sub-processor Through contract or other “organisational steps.”[45] The processor will continue to be fully liable for the controller for performance in the sub-processor’s obligations. Researcher: CrowdStrike blunder https://sites.google.com/view/gdpr-compliance-in-usa/data-privacy-compliance-in-saudi-arabia