Subprocessor Change Notification

What is a subprocessor change notification?

A subprocessor change notification is the notice your vendor sends before it adds or replaces a subprocessor. A subprocessor is a company your vendor hires to handle your data, such as a cloud host or an AI model provider.

The notice exists because of the GDPR, the EU privacy law. Article 28(2) says that when you give a vendor general permission to use subprocessors, it must tell you about intended changes and give you a chance to object. Your data processing agreement (DPA) turns that duty into concrete terms: how much notice, how it is sent, and what you can do about it.

A notice usually comes down to three things:

• The notice period. How many days you get before the new subprocessor starts handling your data.
• The channel. Email, a website update, or a message in your account.
• Your response. Whether and how you can object.

What it looks like in a vendor's terms

A typical clause reads like this:

We will update our subprocessor list and email anyone who has subscribed at least 30 days before a new subprocessor begins processing your personal data. You may object in writing within that period on reasonable data protection grounds. If we cannot resolve your objection, you may end the affected service.

• "Anyone who has subscribed" means notice is opt-in. If no one on your team signed up, you get nothing in your inbox.
• "At least 30 days" is the notice period, counted before the new subprocessor starts.
• "Reasonable data protection grounds" limits why you can object. Price or preference may not count.
• "End the affected service" is often the only remedy. See the right to object.

HubSpot's DPA, for example, says "we will notify you at least 30 days prior" to changes, for customers who opt in.

How long notice periods are in real DPAs

The GDPR does not set a number of days. The European Commission's Q&A says the parties agree on the notice period. Here is what we found in DPAs we opened, as of October 2026:

• Atlassian's cloud DPA: at least 30 days, by email to people who subscribe.
• HubSpot's DPA: at least 30 days, by email to people who subscribe through a form.
• Stripe's DPA: at least 30 days, by email to users who subscribed on its list page.
• Atlassian's FastShift DPA: at least 14 days, sent as a request for approval to the account's technical contact.

So in this sample, notice ran from 14 to 30 days. Your vendor's number may differ, so read your own DPA.

General vs Specific Subprocessor Authorization

GDPR Article 28(2) says a vendor cannot use another processor without your "prior specific or general written authorisation". Those are two different setups.

Specific authorization means you approve each subprocessor by name before it starts. The vendor must ask you each time. Atlassian's FastShift DPA works this way: it promises to ask for your specific approval at least 14 days before it brings in any new subprocessor.

General authorization means you approve future subprocessors in advance, as a group. In return, the vendor must tell you about each intended change and let you object. Atlassian's cloud DPA, HubSpot's and Stripe's all use this setup.

This choice is the legal reason notice periods and objection rights exist. Under general authorization, notice is your only chance to react. The Commission's Q&A adds that if you object under the EU model clauses, the processor may not engage the new subprocessor.

A real change we caught

A notice only helps if the change is visible. Venpo found that SurveyMonkey changed its AI providers on a page still dated November 2025. Anyone checking the date at the top would have missed the update.

Why it matters to you

The notice period is your whole window. Once it ends, the new subprocessor can start receiving your data, whether or not anyone on your team read the notice.

It also feeds your own obligations. If you sell to businesses, your customers may expect notice before your vendors' subprocessors change. A 30-day window upstream leaves you little time to notify your own customers with the same lead time.

And opt-in notice is easy to miss. When notice goes only to subscribers, a vendor can meet its promise while no one at your company sees the email.

What to check

• Find the notice period in the DPA and write it down for each important vendor.
• Check how notice is sent. If you must subscribe, sign up a shared inbox.
• Check whether the DPA uses general or specific authorization.
• Look for exceptions, such as emergency replacements without advance notice.
• Read what happens if you say nothing: is silence treated as approval?
• Compare the vendor's notice period with what you promise your own customers.

How Venpo helps

Venpo watches your vendors' subprocessor lists and DPAs directly, so you see a change even if no one subscribed to the vendor's emails. Each alert explains in plain English who was added or removed and why it matters.