GDPR Article 28(2) lets a processor add subprocessors only with the controller's prior written authorisation, which can be specific or general. Most security vendors use general authorisation with notice of changes. The terms to negotiate are how much notice you get, how you object, and what happens if you do.
What the article requires
A processor cannot engage another processor without prior written authorisation. If the authorisation is general, the processor must inform the controller of intended additions or replacements so the controller has the chance to object. The subprocessor must be bound by the same data protection obligations, and the first processor remains fully liable to the controller for the subprocessor's performance.
Four terms to settle
Where is the list? A public page or a document in the trust center. Ask for the list as part of the DPA so you know what you agreed to at signature.
How are you notified? Email to a named address is better than a page that changes silently. Ask to be subscribed.
How much notice? The article does not set a number. Thirty days is a commonly requested period. Choose one your own team can meet, given that you need time to review a new party.
What can you do? If you object on reasonable grounds and the vendor cannot offer a way around it, the contract should say whether you can terminate and receive a refund for unused time. Without that, the right to object is only a right to complain.
What to check on a new subprocessor
When a notice arrives, run through a short list:
- What service does it provide and what data does it receive?
- Where does it process data?
- Does it use its own subprocessors?
- Does it hold an independent audit report or equivalent?
- Is it replacing an existing subprocessor or adding a new data flow?
Treat additions that add a new type of data or a new region more seriously than a swap of like for like.
Who in your company reads the notices
Notices sent to a shared inbox nobody reads are the same as no notices. Assign a person, set a mailbox rule, and record each notice with your decision, even when it is "no objection". That record is evidence if an auditor asks how you manage vendors.
When the vendor says it cannot give a list
Be careful. A processor that cannot say who touches your data cannot give you the guarantees Article 28 asks for.
Related posts
Publishing a subprocessor list covers the vendor side. Fourth party risk explains why the second layer matters.
Sources
Quick check
Is thirty days notice required by law?
No. Article 28 does not set a number. It is a negotiated term.
Can we say no to a new subprocessor?
You can object. What follows depends on the contract, so write the consequence into it.
Last reviewed: 19 October 2026.
