What’s the difference between controller-to-processor vs processor-to-processor transfers?

A controller-to-processor transfer occurs when you (the data controller) share personal data with a processor (like your ESP) for processing on your behalf. This is the standard arrangement for email marketing. You uupload subscriber data to your ESP so they can send campaigns according to your instructions. This transfer requires a Data Processing Agreement that establishes the processor's obligations and your ongoing control over the data. The processor can only use the data as you direct; they don't become a controller themselves.

A processor-to-processor transfer occurs when your processor shares data with a sub-processor to perform part of the processing. Your ESP might transfer subscriber data to an email deliverability vendor, a cloud infrastructure provider, or an analytics service. These transfers create an extended processing chain where each link must maintain appropriate protections. Your original DPA with the ESP should require that sub-processors are bound by equivalent obligations, and the ESP must have their own contracts (sub-processing agreements) with these sub-processors.

The practical implications differ significantly. For controller-to-processor transfers, you have direct contractual control and ongoing responsibility. You uchoose the processor, define instructions, and can terminate the relationship. For processor-to-processor transfers, your control is indirect. You uauthorize or object to sub-processors, but you don't have direct contracts with them. Your processor is responsible for ensuring sub-processor compliance. This is why processor selection matters so much: you're trusting them not just with your data, but with choosing appropriate sub-processors and maintaining the entire downstream chain of compliance. Every transfer type requires appropriate safeguards, but controller-to-processor gives you direct control while processor-to-processor requires trusting your processor's judgment and oversight.