Usually no. An open source library that runs inside your own application is code you ship, not a company processing personal data on your behalf. A hosted service, API or SDK that sends customer data to a third party is different, and that party is likely a subprocessor.
The test
GDPR Article 28 describes a processor engaging another processor. It requires the controller's prior written authorisation, specific or general, and when approval is general the processor must notify the controller of intended additions or replacements so the controller can object. The sub-processor must be bound by the same data protection obligations, and the first processor remains fully liable to the controller if the sub-processor fails.
The key idea is processing on your behalf. Ask three questions:
- Does the third party receive or access customer personal data?
- Do they do that on your instructions, as part of delivering your service?
- Is there a legal entity you contract with?
A statically linked parser fails question one. A hosted error tracker that receives stack traces with user data passes all three.
Quick classification table
| Component | Subprocessor? | Reason |
|---|---|---|
| Open source library compiled into your app | No | No data leaves your control |
| Open source library that phones home with usage data | Check | Depends on what is sent and to whom |
| Cloud hosting provider | Yes | Stores and processes customer data |
| Hosted logging or analytics service | Yes if it gets personal data | Receives data from you |
| Package registry you pull from | No for customer data | You download, they do not receive customer data |
| Mobile SDK that transmits device identifiers | Often yes | Data goes to the SDK vendor |
What buyers still want to know about libraries
They may not call it a subprocessor question, but they care about the risk. Answer the supply chain question separately: how you inventory libraries, scan them and respond to flaws. See how do you answer how you manage open source dependencies.
Where teams slip
They forget SDKs inside mobile apps and browser scripts, which often do send data out. They also miss tools used by support, such as screen sharing or chat plugins. A periodic check of outbound network destinations and of the build inventory finds these. See third-party SDK and subprocessor inventory for privacy.
How to word your answer
"We do not treat open source libraries embedded in our software as subprocessors because they run within our environment and do not receive customer data. Third-party services that process customer data are listed on our subprocessor page, and we notify customers of changes as our agreement describes."
Confirm the final wording with counsel, since classification depends on your contracts and jurisdiction.
Quick check
Is a public package registry a subprocessor?
Generally no, because it does not process your customers' personal data. It matters for supply chain risk, not for the subprocessor list.
What if a library sends telemetry?
Check what it sends. If it includes personal data, treat the destination as a third party and decide whether to disable it or list it.
Safeguard produces component inventories and dependency reports that help you see what you ship, and offers a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
