Subprocessor lists: what to track and how to handle changes

Track each subprocessor's name, purpose, data processed, location and date added, and subscribe to change notices from every vendor that handles personal data. When a new one appears, check what data it sees and where, then decide to accept or object within the vendor's notice window.

Why the list matters

GDPR Article 28 lets a processor engage another processor only with the controller's prior written authorisation. That authorisation can be general. In that case, the processor must inform the controller of planned additions or replacements, giving the controller the chance to object. A general authorisation without a person reading the notices is the same as no oversight.

Fields worth keeping

A spreadsheet or register with these columns is enough:

1. Vendor and the service you use.
2. Subprocessor name and legal entity.
3. What it does for the vendor.
4. Data categories it touches.
5. Processing location.
6. Date first listed.
7. How you were notified of changes.
8. Your decision and date.

Getting notices

Many vendors publish a subprocessor page and offer an email or feed subscription. Use a shared mailbox, not a personal inbox. If a vendor offers no notice method, ask for one in the contract, with a stated number of days before a change takes effect. Check what the contract says about your right to object and what follows.

Reviewing a new subprocessor

Ask in order:

• What data? Does it see personal data, credentials or only metadata?
• Where? Does it move data to a new country? That may need transfer safeguards. Ask counsel.
• Why? Is this a replacement for an existing one or an addition?
• Who is it? Check its own security page, audit reports and breach history that you can find from reputable sources.
• Contract flow-down. Ask the vendor to confirm that the same data protection terms bind it.

Objecting

Know in advance what your objection can do. Possible outcomes include the vendor offering an alternative, you terminating, or a settlement on timing. If the contract is silent, you have little leverage, which is a reason to fix it at renewal.

Do not forget the long tail

AI features often add a model provider as a new subprocessor. Analytics, support chat and email tools do too. Reread the list after every product announcement from a critical vendor.

Your own list

You are probably also a processor for your customers. Publish your own list and keep it current. It is among the first things buyers ask for. See trust center content.

Quick check

Sources

• GDPR Article 28

Last reviewed: 19 October 2026.