Fourth-party risk is the risk that comes from the companies your vendors depend on, such as their hosting provider or support tool. You cannot review all of them. Find the ones that touch your data, ask your vendor to name them, and make sure contracts flow your requirements down.
Defining the terms
You are the first party. Your vendor is the third party. The vendor's own suppliers are fourth parties. When a hosting provider fails, your vendor goes down, and so do you, though you never signed anything with the host.
Why regulation cares
Under GDPR Article 28, a processor needs the controller's prior written authorisation before engaging another processor, either specific or general. With general authorisation, the processor must tell the controller about planned additions or replacements and give it a chance to object. The processor must also bind the sub-processor to the same data protection obligations, and stays fully liable to the controller if the sub-processor fails.
That is a legal structure for one slice of the problem: personal data. The same logic is sensible for security more broadly.
Step 1: Ask for the list
Request the vendor's subprocessor or critical supplier list. Many publish one. Look for hosting, email delivery, analytics, support, payment and AI model providers. Our post on subprocessor lists explains how to track changes.
Step 2: Focus on what touches your data
For each fourth party ask three things:
- Does it store or process our data?
- Could its failure stop the service?
- Does it have a different country of operation than the vendor?
Most will be low concern. Two or three will matter.
Step 3: Contract terms
Look for clauses that require:
- Notice before adding or replacing a subprocessor.
- The same security and data protection obligations flowing down.
- A right to object or terminate.
- Notice of incidents at the subprocessor that affect you.
Step 4: Watch for concentration
If five of your vendors run on the same cloud region, one outage hits all five. You cannot fix that alone, but you can plan for it: know which processes would stop and keep a manual fallback for the worst one.
Step 5: Software supply chain
Software you build also has fourth parties: open source libraries and their maintainers. An SBOM shows what your suppliers' software contains. Our post on checking a supplier SBOM covers the review. Safeguard's SBOM and dependency scanning can map your own code's dependency tree, with a free scan at https://gold.safeguard.sh/scan.
What not to do
Do not send a full questionnaire to your vendor's vendors. You have no contract with them. Work through your vendor, who has one.
Quick check
Do I need to assess my vendor's subprocessors myself?
Not usually. Ask the vendor how it assesses them, and review directly only the few that handle your most sensitive data.
Does GDPR cover fourth parties?
Article 28 covers sub-processors of personal data. Other fourth-party exposure is a risk decision, not a legal duty under that article.
Sources
Last reviewed: 19 October 2026.
