Subverwerker

Subverwerker is the Dutch term for a subprocessor in the context of data protection and privacy law. It refers to a third party engaged by a data processor to perform processing activities on personal data on behalf of a data controller. The controller remains responsible for ensuring that processing complies with applicable law, while the processor remains liable for the acts of the subprocessor in accordance with the governing contract and data protection obligations.

Under laws such as the EU General Data Protection Regulation, a processor may appoint subprocessors to help carry out processing tasks, but only if there is a binding contract that imposes equivalent data protection obligations on the subprocessor. This is typically set out in a data processing agreement (DPA). The agreement covers purposes of processing, categories of data, processing duration, technical and organizational measures, incident notification, data return or destruction, and audit or inspection rights.

Change management is a practical consideration: processors generally must obtain prior authorization from the controller before engaging a subprocessor, and the controller may be given the right to object to or terminate the use of a proposed subprocessor. Subprocessor arrangements must be documented, and any changes should be communicated to the controller.

In practice, subprocessors are common among cloud providers and IT service vendors, where multiple services involve shared processing operations. When data is transferred or processed across borders, additional safeguards may apply. Overall, the subverwerker concept helps distribute processing responsibilities while maintaining accountability for data protection throughout the processing chain.