Subprocessor

A third party that a data processor engages to process personal data on behalf of its customer, such as a hosting provider or an email service.

Under the GDPR, a company that processes personal data for its customers is a processor, and the vendors it relies on to do that are subprocessors. A SaaS company's cloud provider, email delivery service and support desk are typical examples.

Article 28 of the GDPR requires a processor to have its customer's authorisation before engaging a subprocessor and to tell the customer about changes. In practice, most companies meet this by publishing a subprocessor list and pointing to it from their data processing agreement. A trust center can email subscribers when a vendor is added or removed.

What a reviewer wants to see

• Each vendor's name, purpose and processing location
• A list that is current, with a date
• How customers are told about changes
• A way to be told when the list changes