Third-Party vs Fourth-Party Risk

The short answer

Third parties are the vendors you pick, pay and sign terms with. Fourth parties are the companies those vendors rely on, which you did not pick and often cannot see.

You manage third-party risk through your own contracts and reviews. You manage fourth-party risk mostly through your vendor: its subprocessor list, its DPA and the promises it makes about its own suppliers.

Third-party risk

• What it is: the chance that a vendor you use causes you harm, such as a data breach, an outage, a price increase or a change to its terms. See third-party risk management.
• Who it binds: you and the vendor, through your contract, order form and DPA.
• How you manage it: a vendor risk assessment before you sign, a review of SOC 2 reports and security answers, and checks at renewal.

Fourth-party risk

• What it is: the same kinds of risk, one step further away. If your vendor's cloud host goes down or its AI provider changes how it uses data, you feel it. See fourth-party risk.
• Who it binds: your vendor and its supplier. You are usually not a party to that contract.
• How the law helps: under GDPR, a processor may not bring in another processor without the controller's "prior specific or general written authorisation," and, when the approval is general, must tell the controller about changes so it can object (Article 28(2)). It must pass the same data protection duties down to that subprocessor, and it stays "fully liable to the controller" for the subprocessor's work (Article 28(4)).

Here is how the chain works when you upload data:

1. You put customer data into your vendor's product (third party).
2. Your vendor stores it with a cloud provider and may send some of it to other services, such as an email delivery tool or an AI model provider (fourth parties).
3. Those services may use their own providers in turn, which your vendor may or may not disclose.

Which one applies to you

Both, but you control them in different ways.

• Third parties: you can negotiate, review and leave. Your contract is your main tool.
• Fourth parties: you rely on notice. Check whether your vendor publishes a subprocessor list, how much notice it gives before adding one, and what you can do if you object.
• Real example of notice terms: the Atlassian DPA promises notice "at least thirty (30) days before" a new subprocessor handles your personal data. If you object, your only remedy is to terminate the order for the affected product (section 4.3).
• Your own customers: if you are a SaaS company, your vendors are fourth parties to your customers. Their DPAs may ask you to list your subprocessors and give notice of changes, so a change at your vendor can become a notice you owe. See how to notify customers of a new subprocessor.
• Concentration: several of your vendors may share the same fourth parties, such as one cloud host or one AI provider. See concentration risk.

Example

AI providers are a newer kind of fourth party. When a vendor adds an AI feature, it may send your data to a model provider to run it.

Venpo found that at least 30 vendors added Anthropic as a subprocessor since September. Between September 1 and October 8, 2026, Anthropic appeared on the subprocessor pages of 31 vendors. For a customer of those vendors, Anthropic became a fourth party without any new contract on the customer's side.

Another change Venpo caught: Persona added ClickHouse as a required subprocessor. "Required" means you cannot switch it off, so your choice is to accept the new fourth party or leave the vendor.

How Venpo helps

Venpo monitors your vendors' subprocessor lists, so fourth parties become visible. When a vendor adds or removes a subprocessor, you get a plain-English email with what changed and why it matters, along with a change history per vendor.