How to Notify Customers of a New Subprocessor

What is a new subprocessor notice?

A new subprocessor notice is the message you send customers before a new outside company starts handling their personal data for you. That company is a subprocessor: for example, a new AI provider behind a feature, or a new support tool.

The duty comes from your contracts and, for EU data, from the GDPR. When customers give you a general authorization to use subprocessors, GDPR Article 28(2) says you must inform them of intended additions or replacements so they have the chance to object. The European Data Protection Board adds that you should actively flag each change rather than only updating a list (EDPB Guidelines 07/2020, paragraph 128).

Your DPA usually sets the details: how much notice, through which channel, and what a customer can do if they object.

What it looks like in a vendor's terms

A typical clause reads like this:

Provider will notify subscribed Customer contacts by email at least 30 days before a new Subprocessor processes Customer Personal Data. Customer may object in writing within that period on reasonable data protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected service.

• Subscribed contacts means only people who signed up get the email. If nobody at the customer signed up, the notice may still count as given.
• 30 days is the notice period. The new company cannot get data before it ends.
• Object in writing is the right to object. Many DPAs require a data protection reason, not just a preference.
• Terminate the affected service is often the only remedy if you and the customer cannot agree.

Real DPAs follow this pattern. HubSpot says it will notify opted-in customers "at least 30 days prior to any such change" (HubSpot DPA). Atlassian's DPA also gives 30 days and lets the customer end the affected order if it objects. Stripe's DPA gives 30 days too.

A real change we caught

Venpo flagged that Persona added ClickHouse as a required subprocessor. A required subprocessor is one the customer cannot switch off, so the choice is to accept it or object under the contract. That is exactly the kind of change your own customers expect to hear about from you.

Why it matters to you

A missed notice is a breach of your own DPA. A customer who finds a new company in your data flow without warning may raise it in a renewal or an audit, and they may have a right to terminate.

Your notices also depend on your vendors. If your support desk adds a new AI model provider, that company may now process your customers' data. Changes like this are common: at least 30 vendors added Anthropic as a subprocessor since September. You can only notify your customers on time if you hear about these changes from your own vendors first. This chain is part of fourth-party risk.

What to check

• Read your own DPA. Note the notice period, the channel (email, in-app, web page) and the objection steps you promised.
• Keep a signup form on your subprocessor list page, and invite each new customer's privacy or security contact to join it.
• Send the notice before the new company gets any data, and count the days from the date you send it.
• Update the list page and its date on the same day you send the email.
• Keep a copy of each notice and the recipient list. It is your proof if a customer later says they were never told.
• Track the subprocessor change notifications your own vendors send you, so a change in their chain reaches your customers in time.

A simple notice template

You can adapt this plain email. Fill in the brackets and keep it short.

Subject: Notice of a new subprocessor at [Your company]

We plan to add [Subprocessor name] as a subprocessor on [date, at least the number of days your DPA promises from today].

What it does for us: [one plain sentence, for example "hosts our support chat"].

Data it will handle: [types of personal data]. Where: [country or region].

Our updated list is at [link]. If you want to object under our DPA, reply to this email by [deadline] and tell us your reason.

Avoid marketing language in the notice. Customers read it as a legal notice, and clear facts make it easier to review.

How Venpo helps

Venpo watches the subprocessor lists and DPAs of the vendors you use and emails you when one adds a company, with what changed and why it matters. That gives you the early warning you need to send your own customer notices on time.