Glossary
Subprocessor
Short answer
A subprocessor is a third party engaged by a data processor to process personal data on behalf of the controller, for example a cloud host used by a software vendor. Under GDPR Article 28, the controller must authorize subprocessors in writing, and the processor stays fully liable for them.
By Pactinel editorial teamReviewed on October 22, 2026
If a customer uses a SaaS product, the vendor is the processor, and the vendor's hosting provider, email delivery service or support tool may be subprocessors.
What GDPR Article 28 says
- The processor needs the controller's written authorization to engage another processor, either specific or general.
- Under general authorization, the processor must inform the controller of intended additions or replacements and give it a chance to object.
- The subprocessor must be bound by the same data protection obligations as the processor.
- The original processor remains fully liable to the controller if the subprocessor fails to comply.
What a subprocessor list contains
| Item | Why it matters |
|---|---|
| Name and service | Identifies who handles the data |
| Country of processing | Triggers transfer rules |
| Data categories | Shows the exposure |
| Date added | Lets you see changes |
Example
A vendor publishes its subprocessor list and promises 30 days' notice of additions. If a new subprocessor in a third country appears, the customer has the notice period to object. A reviewer should diarize that period.
See data processing agreement for the contract that sets these terms.
This is general information, not legal advice.