Subprocessor

What is a subprocessor?

A subprocessor is a company that your vendor hires to handle your data on its behalf. Your vendor is the data processor: it processes personal data for you. When it hands part of that work to another company, that company is a subprocessor.

You are the data controller. That means you decide why and how the data is used, as defined in Article 4 of the GDPR, the EU privacy law. The GDPR's Article 28 calls a subprocessor "another processor" and sets rules for using one.

Subprocessors are everywhere in SaaS. A few common kinds:

• Cloud hosting. Stripe's sub-processor list names Amazon Web Services as a cloud service provider.
• AI models. HubSpot's sub-processor page lists OpenAI as an AI service provider for HubSpot AI.
• Payments and support. Stripe's data processing agreement says it acts as a data processor for the businesses that use it, and as a controller for some data, so a payment company can sit in your vendor's chain too.
• Email delivery, analytics, chat and calling tools that a vendor builds into its product.

Vendors disclose their subprocessors on a subprocessor list. They agree to the rules for adding new ones in their data processing agreement (DPA), the contract that covers how they handle personal data for you.

Why a subprocessor is a fourth party

Your vendor is your third party: a company outside your business that you signed up with. Its subprocessors are your fourth parties. You have no contract with them, you did not pick them, and you often do not know their names until you read the list.

That gap is the core of fourth-party risk. Your data can end up with a company you never reviewed, under a contract you never saw. Your only levers are the promises your vendor made in its DPA.

Here is how one record can move down the chain:

1. You add a customer's name and email to a SaaS tool. You are the controller.
2. The SaaS vendor stores and processes that record for you. It is your processor.
3. The vendor runs on a cloud host, which stores the record on its servers. The host is a subprocessor.
4. The vendor sends the record's text to an AI model provider to power a feature. That provider is another subprocessor.
5. The AI provider may run on its own cloud host. Each link must be bound by the same data protection duties, under Article 28(4).

What a vendor must do before using a subprocessor

Article 28 puts several duties on your vendor. They apply when the GDPR covers the data, and many DPAs repeat them for all customers.

• Get your permission first. A processor cannot bring in another processor without the controller's "prior specific or general written authorisation" (Art. 28(2)).
• Tell you about changes. Under a general permission, the vendor must tell you about intended additions or replacements and give you the chance to object. The EDPB, the body of EU privacy regulators, says the processor must actively inform you of any change to the list.
• Name names. The European Commission's Q&A on standard clauses says the processor must give the names of individual subprocessors, not just categories.
• Pass the duties down. Each subprocessor must be bound by contract to the same data protection obligations. These are called flow-down obligations.
• Stay on the hook. If a subprocessor fails, the vendor remains "fully liable" to you for it (Art. 28(4)).

Processor vs Subprocessor

A processor works directly for you. You signed its terms, and its DPA is a contract between you and it. A subprocessor works for your processor. Its contract is with your vendor, not with you.

Responsibility runs up the chain, one link at a time:

1. The subprocessor answers to your vendor, under the contract your vendor made it sign.
2. Your vendor answers to you, and stays fully liable for the subprocessor's data protection failures.
3. You answer to your own customers and to regulators, because you are the controller.

The UK regulator, the ICO, explains that if a controller pays compensation for a subprocessor's failings, it can claim it back from the processor. The processor can then seek it from the subprocessor.

The same company can play both roles. A cloud host is your processor if you host with it directly, and a subprocessor when your vendor hosts there.

What it looks like in a vendor's terms

A typical clause reads like this:

You give us general permission to use subprocessors. We keep a current list on our website. We will tell you about a new subprocessor at least 30 days before it starts handling your personal data. You may object on reasonable data protection grounds during that time. We will bind each subprocessor to terms at least as protective as this agreement, and we remain responsible for its work.

• "General permission" means you approve future subprocessors in advance, subject to notice. The alternative is approving each one by name.
• "A current list" is the subprocessor list. Check whether notice goes to you directly or only to people who subscribe.
• "At least 30 days" is the notice period. It is your window to review and object.
• "May object" is your right to object. Read what happens next: often the only remedy is ending the service.
• "At least as protective" is the flow-down promise.
• "Remain responsible" keeps the vendor liable for the subprocessor.

Atlassian's DPA, for example, promises notice "at least thirty (30) days before allowing any new Sub-processor".

A real change we caught

Venpo tracked how often AI model providers show up on vendor lists. Between September 1 and October 8, 2026, it recorded Anthropic being added to the subprocessor pages of 31 vendors, as reported in At least 30 vendors added Anthropic as a subprocessor since September. Each of those additions is a new company that may receive data your team puts into those tools.

Single changes matter too. Venpo flagged that Persona added ClickHouse as a required subprocessor, which adds a new link to the chain behind that product. Some vendors change their lists often: RingCentral adds AI subprocessors almost every month.

Why it matters to you

Your data goes further than your contract. When a vendor adds an AI subprocessor, text from your account may now reach a model provider. You may have chosen the vendor partly because it did not do that.

You owe answers to your own customers. If you sell to businesses, their DPAs may ask you to list your own subprocessors. Your vendors are on that list, and their subprocessors sit behind them. A change upstream can mean you need to notify your own customers.

Location matters. A new subprocessor in another country can mean your data leaves the region you promised. Transfers out of the EU need a legal basis such as standard contractual clauses.

Windows are short and easy to miss. Many vendors only send notice to people who subscribe. HubSpot, Stripe and Atlassian all send change emails to subscribers of their list. If nobody on your team subscribed, the window can open and close without anyone seeing it.

A breach anywhere in the chain reaches you. If a subprocessor is breached, your vendor's breach notification clause decides how fast you hear about it.

What to check

• Find the vendor's subprocessor list and note who handles hosting, AI, support and payments.
• Check whether the DPA gives general or specific permission, and how many days of notice you get.
• Find out how notice is sent. If it goes only to subscribers, subscribe a shared inbox, not one person.
• Read what happens if you object. Look for a refund of prepaid fees if your only option is to leave.
• Check where each subprocessor is located and what transfer mechanism covers it.
• Confirm the DPA says subprocessors get the same protections and that the vendor stays liable.

How Venpo helps

Venpo monitors your vendors' subprocessor lists and DPAs. When a subprocessor is added, removed or moved, you get a plain-English email alert that says what changed and why it matters, and each vendor keeps a change history you can look back on.