Subprocessor

A subprocessor is a third-party service provider contracted by a data processor to process personal data on behalf of the data controller. In data protection regimes such as the GDPR, processors may engage subprocessors only with the controller’s prior written authorization and under a contract that imposes data protection obligations at least as stringent as those in the main agreement.

The controller determines the purposes and means of processing; the processor acts on the controller’s behalf. Subprocessors are used to carry out processing tasks, often including cloud hosting, data analytics, payment processing, or customer support. The processor remains responsible to the controller for the subprocessor’s data handling.

Contractual controls require a written data processing agreement that binds the subprocessor to data protection obligations, including implementing technical and organizational measures, assisting with data subject rights requests, notifying data breaches, and ensuring flow-down of terms to any further subprocessors. The processor must maintain an up-to-date list of subprocessors and typically provide advance notice before changes, allowing the controller to object where required by law.

Rights and liability: The controller has the right to approve or object to proposed subprocessors. The processor remains liable to the controller for the subprocessor’s processing, and the subprocessor is directly liable as appropriate under the contract.

Subprocessors are a common feature of outsourced processing arrangements and are a key element of modern data protection compliance, requiring clear governance to manage risk and ensure transparency.