A subprocessor list should name each third party that processes customer personal data for you, what it does, where, and when the list last changed, with a way for customers to hear about changes. Article 28 of the GDPR is the reason buyers ask.
What the law says
Under GDPR Article 28, a processor needs the controller's prior written authorisation before engaging another processor. That authorisation can be specific to one subprocessor or a general authorisation. With a general authorisation, the processor must inform the controller of intended additions or replacements so the controller can object. The processor must also impose the same data protection obligations on the subprocessor, and remains fully liable to the controller if the subprocessor fails.
This is legal text, not advice. Have counsel check your contracts.
Columns that help
Use a table with these columns:
- Name of the subprocessor.
- Purpose. What it does with the data, in a few words.
- Data involved. Categories, such as account data or log data.
- Location. Country or region of processing.
- Date added.
Leave out vendors that never touch customer personal data, such as your internal chat tool, unless they do.
Change notification
If your contracts use a general authorisation, you need a notice process. Common patterns are an email list customers can join, a notice period before additions take effect and a stated way to object. Pick a notice period you can honour and write it into the page and the contract.
Keep a change log
Show dated additions and removals. A reviewer comparing your list to the one in their records will want to see why something moved.
Make it match the contract
The list on your page should match the one in your data processing agreement and your questionnaire answers. Mismatches are the most common finding in vendor reviews. See what to publish on a trust page.
Build it from facts
Start from your vendor register and procurement records, not memory. Ask each team which services receive customer data, including analytics, support and error tracking tools, since those are often missed.
Review cadence
Review quarterly and whenever a new vendor is approved. Make the approval step include "does this vendor process customer data, and is the list updated?"
Sources
Quick check
Do we list our cloud provider?
Yes, if it processes customer personal data on your behalf, which hosting generally does.
Can the list be behind a login?
Some companies do this, but a public list is easier for reviewers and removes a request step.
Last reviewed: 19 October 2026.
