My website (a privacy-focused, web-based app suite) is built so the service itself never knows who’s using it — no accounts, no email, access runs on credit codes that can’t be traced back to a person.
Payment still goes through a third-party Merchant of Record, which necessarily holds real customer data to process the transaction — email, billing info. Technically this is a subprocessor relationship: GDPR’s data minimization principle (Article 5(1)(c)) is satisfied on my own system, but the same can’t be said with the same rigor at the subprocessor’s level — and as admin, I still have access to a dashboard containing other people’s personal data.
Is there an established, documented practice for minimizing or governing this kind of access inherited from a subprocessor — logging every admin login, least-privilege roles, periodic access review? Or is there a more obvious, accepted approach I’m missing?