Flow-Down Obligations

What are flow-down obligations?

Flow-down obligations are duties your vendor must pass on to the companies it hires. If your vendor promises to protect your data in certain ways, it must make its own subprocessors promise the same.

Under the GDPR, the EU privacy law, this is required. Article 28(4) says a subprocessor must be bound by contract to the "same data protection obligations" as in your contract with the vendor. If the subprocessor fails, your vendor stays "fully liable" to you.

The EDPB, the body of EU privacy regulators, adds that the subprocessor contract must also include the duty to allow audits by you or your auditor.

What it looks like in a vendor's terms

A typical clause reads like this:

We will enter into a written agreement with each subprocessor that protects your personal data to at least the same standard as this DPA. We remain liable to you for any subprocessor's failure to meet its data protection obligations.

• "Written agreement" means the duties are in a contract, not just a policy.
• "At least the same standard" is the strength of the flow-down. Weaker wording such as "comparable" leaves more room.
• "Remain liable" means you can hold your vendor responsible even though you have no contract with the subprocessor.

Wording differs between DPAs we opened, as of October 2026. Atlassian promises protection "to the same standard provided by this DPA". HubSpot promises at least the same level of protection, where applicable. Stripe promises obligations comparable to those in its DPA.

Why it matters to you

You cannot read the contracts between your vendor and its subprocessors. Flow-down wording is your only assurance that the protections you negotiated travel with your data.

It covers the whole chain. If a cloud host or AI subprocessor mishandles your data, the flow-down promise and the liability line are what let you go after your vendor. This is a large part of managing fourth-party risk.

If you are a vendor yourself, the same rule applies to you. Your customers may ask how you pass your DPA terms down to your own providers.

What to check

• Find the flow-down sentence in the DPA's subprocessor section.
• Check the strength of the wording: "same" or "no less protective" is stronger than "comparable".
• Confirm the vendor stays liable for its subprocessors.
• Check that audit and breach notice duties are included in what flows down.
• Ask for a summary of key subprocessor terms if a provider handles sensitive data.

How Venpo helps

Venpo monitors your vendors' DPAs and subprocessor lists. If flow-down or liability wording changes, or a new subprocessor appears, you get a plain-English email alert that explains the change.