What is a sub-processor?
A sub-processor is a third party that processes personal data on behalf of a processor, rather than directly for the controller. Under GDPR a processor needs the controller’s written authorisation to use one, and must tell the controller about changes to its sub-processors so the controller can object.
Where sub-processors sit
GDPR separates the controller, which decides why and how personal data is processed, from the processor, which handles the data on the controller’s instructions. When a SaaS company processes its customers’ data, the customer is usually the controller and the SaaS company the processor. Each service the SaaS company passes that data to, such as its cloud host, support desk or email delivery service, is a sub-processor.
Services that never touch the controller’s personal data are not sub-processors, even if the processor pays for them. An accounting tool that holds only the processor’s own invoices is an ordinary supplier.
What GDPR requires
Most Data Processing Agreements use general authorisation. The processor publishes a list of its sub-processors, with what each one does and where it processes data, and commits to giving notice before changes, often thirty days. The agreement sets out what happens if the controller objects.
- Authorisation. Article 28(2) requires the controller’s prior specific or general written authorisation before a sub-processor is engaged.
- Notice of changes. Under a general authorisation, the processor must tell the controller about intended additions or replacements, giving it the chance to object.
- Same obligations. Article 28(4) requires the processor to pass the same data protection obligations down to the sub-processor by contract.
- Liability. If the sub-processor fails to meet those obligations, the original processor remains fully liable to the controller.
Transfers and due diligence
Where a sub-processor is outside the European Economic Area, the transfer needs a lawful basis under Chapter V of GDPR, such as an adequacy decision or the Standard Contractual Clauses. The 2021 Standard Contractual Clauses include a module for transfers from one processor to another.
Buyers’ security questionnaires ask for the sub-processor list, and a SOC 2 report names the subservice organisations the service relies on, which often overlap with it. Keep the list, the contracts and the change notices together, and review each sub-processor as part of vendor risk management, with the depth of review set by the data it holds.
Questions
Sub-processor, answered
Is every vendor a sub-processor?
No. Only vendors that process the controller’s personal data on the processor’s behalf. A vendor that handles only your own business data is an ordinary supplier, though it may still need a vendor risk review.
Can a customer block a new sub-processor?
Under a general authorisation, the customer can object to a change. What happens next is set by the Data Processing Agreement. Often the parties discuss alternatives, and the customer may have a right to terminate the affected service.
Does HIPAA have sub-processors?
HIPAA uses different terms. A business associate that passes protected health information to its own subcontractor needs a Business Associate Agreement with that subcontractor, which is the HIPAA equivalent.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them