The relationship between a controller and processor must be governed by:

• A.No formal arrangement is needed, citing Article 28(3)(c), which lets the processor determine its own security measures independent of the controller's instructions
• B.A contract or other legal act under EU or Member State law
• C.A verbal agreement
• D.An informal email exchange, per Article 28(2), which lets a processor engage a sub-processor without informing the controller at all