What are the specific considerations for sub-outsourcing?

If sub-outsourcing of critical or important functions is permitted, the written agreement should:<br/><br/> 

1. specify any types of activities that are excluded from sub-outsourcing;<br/><br/> 

2. specify the conditions to be complied with in the case of sub-outsourcing;<br/><br/> 

3. specify that the service provider is obliged to oversee those services that it has sub- contracted to ensure that all contractual obligations between the service provider and the institution or payment institution are continuously met;<br/><br/> 

4. require the service provider to obtain prior specific or general written authorisation from the institution or payment institution before sub-outsourcing data;<br/><br/>

5. include an obligation of the service provider to inform the institution or payment institution of any planned sub-outsourcing, or material changes thereof, in particular where that might affect the ability of the service provider to meet its responsibilities under the outsourcing agreement. This includes planned significant changes of sub- contractors and to the notification period; in particular, the notification period to be set should allow the outsourcing institution or payment institution at least to carry out a risk assessment of the proposed changes and to object to changes before the planned sub-outsourcing, or material changes thereof, come into effect;<br/><br/>

6. ensure, where appropriate, that the institution or payment institution has the right to object to intended sub-outsourcing, or material changes thereof, or that explicit approval is required;<br/><br/>

7. ensure that the institution or payment institution has the contractual right to terminate the agreement in the case of undue sub-outsourcing, e.g. where the sub-outsourcing materially increases the risks for the institution or payment institution or where the service provider sub-outsources without notifying the institution or payment institution.