Does the undertaking conclude data processing agreements with its service providers?

Processor agreements result from the privacy register, not from the CSRD

This question concerns the GDPR, not the source provided. Directive (EU) 2022/2464 (CSRD) requires reporting on sustainability, including own business conduct and chain approach on social and governance matters — but the obligation to conclude processor agreements with service providers processing personal data is not contained in that directive. With the source provided here, neither a yes nor a no can be substantiated: the label is set to "to be determined" and will remain so until a GDPR source is in the file.

That does not mean the question is uninteresting. Those with customers asking this have usually already recorded somewhere which service providers process personal data — that overview is part of the record of processing activities. From that record it is immediately clear which parties need a processor agreement: every party that processes personal data on behalf of the company falls under this. Without that record, answering the question about processor agreements in practice is difficult, regardless of what is provided as source here.

Why this topic is separate from the source provided

The CSRD (Directive (EU) 2022/2464) governs the obligation to report on sustainability information and thereby affects chain relationships, but it contains no provision on processor agreements in the sense of data protection. That obligation follows from the GDPR, Article 28. As long as that source has not been added to the file, this answer remains on "to be determined" — just as with a related data breach incident, the answer depends on what was reported when a data breach occurred. Provide evidence, only then a yes or no.