---
title: "Processors and transfers · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/processors-and-transfers
updated: 2026-10-20
licence: "All rights reserved"
---

# Processors and transfers

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> List every vendor that touches your data with its contract, region and transfer basis, publish your subprocessors, and check AI providers' terms on training.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/processors-and-transfers`.

## Required

- [Keep one register of vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register): Keep one register of every vendor that handles personal data or reaches production. Fail the build when the code uses a vendor not in it.
- [Check each agreement covers Article 28](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28): Check every data processing agreement against the list in GDPR Article 28(3), and record the result and the breach notice deadline in the vendor register.
- [Publish your subprocessors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/subprocessor-list): If you process personal data for business customers, publish your subprocessor list at a stable address and tell customers before you add one.
- [Record a legal basis for every transfer](https://agentwranglers.se/playbook/compliance/processors-and-transfers/transfer-basis): For every store or vendor outside the European Economic Area, record the transfer basis under GDPR Chapter V. Contract clauses also need a transfer impact assessment.
- [Check the Data Privacy Framework status of US vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpf-status): Rely on the EU-US Data Privacy Framework only for US vendors on its active list. Check the list monthly and keep signed contract clauses as a fallback.
- [Rank vendors and check their evidence](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-tiers): Rank every vendor by the data and access it has, and require current security evidence for the top tier.
- [Record the data terms of every AI provider](https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms): Give every AI model provider a vendor register entry with its plan, its training setting, its retention and its region. Allow only plans that do not train on your data.

## Recommended

- [Confirm deletion when a vendor leaves](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-exit): When you stop using a vendor, get written confirmation that it deleted or returned your data, before you remove it from the register.

- Previous: [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map)
- Next: [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting)
- [All chapters](https://agentwranglers.se/playbook/compliance)