Lapsed Data Privacy Framework Certification and a New Subprocessor
Cadence People sells HR software to 900 employer clients, mostly in the EU. Its Dublin subsidiary contracts with clients as a processor; the Boston parent hosts the platform and acts as subprocessor. Until last month the Boston entity relied on its EU-US Data Privacy Framework certification for both controller and HR data. On February 2 the privacy team learns the certification lapsed: the annual re-certification was not completed, and the Department of Commerce list shows the organization as inactive. SCCs from 2021 exist with some clients but not all. A new Chennai support center began handling EU tickets in January; client contracts require 30 days' prior notice and a right to object before adding a subprocessor, and notice went out January 18. One German client, whose workforce is covered by a works council, has demanded the transfer impact assessment and threatened to suspend data flows.
1. What is the immediate consequence of the lapsed DPF certification, and what transfer mechanism should Cadence rely on now?
Read the worked answer
DPF adequacy applies only while an organization is on the active Data Privacy Framework List. Once certification lapses, the Boston entity is an ordinary US recipient in a third country and needs an Article 45 or 46 tool, in practice the 2021 SCCs: Module 2 for client-to-processor transfers and Module 3 for processor-to-processor flows between Cadence Dublin and Cadence Boston.
SCCs signed now operate prospectively. They do not retroactively legitimize transfers made while there was neither certification nor clauses; that gap must be documented and, where the client is a controller, disclosed. Re-certifying with Commerce is the right medium-term fix because it restores a simpler mechanism, but it should not be presented as instant cover for the gap, and some clients will still insist on clauses.
Immediate actions: inventory which client contracts already contain SCCs and which do not, suspend or re-paper transfers with no mechanism, execute Module 3 for the intra-group flow, and answer the German client with a written remediation plan rather than an assurance that the company is certified.
2. Assess the Chennai subprocessor addition against the contractual and Chapter V requirements.
Read the worked answer
Article 28(2) permits general written authorization for subprocessors only if the controller is informed of intended changes and can object. Cadence gave 30 days' notice, matching the contracts, but the notice does not validate the change by itself: if the German client objects within the window, Chennai cannot process that client's data, and the practical answer is an exclusion list or a delayed onboarding.
Because the cadence is controller-to-processor at the client level and processor-to-processor internally, the subprocessor agreement must flow down Module 3 obligations and Article 28(3) terms: processing only on instructions, confidentiality, security, assistance with data subject rights, deletion or return, and audit rights.
India has no EU adequacy decision, so a transfer impact assessment is required before the flow began. It should examine Indian government access law, the DPDP Act 2023 framework, contractual obligations to notify government requests, and whether the support model can be narrowed, for example no access to free-text fields, EU-based key management, or remote support through an EU gateway. Starting the flow in January and papering it in February is exactly what an auditor will write up.
3. What should the TIA cover for the German client, and can one TIA serve all 900 clients?
Read the worked answer
A usable TIA should identify the data categories, the data subjects, the transfer path, the mechanism relied on, the relevant third-country law and practice on public authority access, the redress available to data subjects, and the supplementary measures actually in place rather than planned. For a support center the critical facts are what Chennai staff can see (ticket bodies, attachments, free-text notes) and whether that access can be masked or minimized.
One template can be shared, but a single TIA should not be presented as covering all clients. The controller is the client, and the controller must be able to make and record its own assessment; a processor cannot substitute its judgment for the controller's. Provide a detailed template with client-specific addenda and disclose the support model honestly.
The German angle deserves separate attention: works council co-determination over monitoring technology may require consultation, and a TIA asserting that no human reads employee data will collapse the moment the client learns that support staff read tickets. Consistency between the document and the operating reality is the whole point.