body: Should a complete list of processors or sub-processors be written anywhere for GDPR compliance?
  If so, who is required to do so? Controllers, processors, sub-processors?
  And where should the list be written? Privacy policies, data processing agreements (DPAs), other documents?
  
  
  Quoting article 28, paragraph 2, it seems sub-processors must be written in DPAs between a controller and a processor, but it's not clear to me whether the sub-processors list should be explicit or not:
  
  
  
  > 
  > The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.
  > 
  > 
  > 
  
  
  In all other cases I'm not sure whether any processors or sub-processors should be written anywhere. For example, I didn't find any information about listing processors in privacy policies. 
  
  
  I found a related question [here](https://law.stackexchange.com/questions/17918/resellers-under-gdpr-disclosure-of-data-processors-or-countries-of-data-storag) about a specific case, but what I'm asking is more general.
  
  
  
title: For GDPR compliance, what documents or contracts need to contain a list of processors or sub-processors?