Sub-Processor
A third party engaged by a Data Processor to carry out processing activities on behalf of the Data Controller.
Full Definition
A Sub-Processor is any third party that a Data Processor engages to process personal data on behalf of the Data Controller. Under GDPR, processors must obtain the controller's prior written authorisation before engaging sub-processors — either specific authorisation or general authorisation (with the right to object to new sub-processors). Processors remain fully liable to the controller for the sub-processor's compliance. Sub-processor chains must be documented, and the obligations imposed on sub-processors must be at least equivalent to those imposed on the processor under the Data Processing Agreement. Organisations commonly use a public sub-processor list to provide transparency.
How each law treats it
The processor must have the controller's prior specific or general written authorisation before engaging another processor. The processor remains fully liable to the controller for the sub-processor's compliance.
DPDP does not use the term 'sub-processor' but Processors who engage others on behalf of a Fiduciary pull them into the Fiduciary's accountability chain.
A service provider's downstream contractors must satisfy the same service-provider contract requirements. The customer-facing service provider remains the primary accountable party.
In practice
- Maintain a public sub-processor list and keep it evergreen. Change-notification clauses expect it to exist.
- Give customers 30 days' notice to object to new sub-processors; the industry standard is email + status-page notification.
- Pass through the required contract terms. The sub-processor must sign a contract that imposes at least the same obligations the processor carries.
Common pitfalls
- Treating the sub-processor as an onward recipient. The two have different legal footprints — a sub-processor acts on the controller's behalf; an onward recipient is a controller in its own right.
- Changing the sub-processor list without notifying customers. The DPA will usually require explicit notice.
- Not performing the same due diligence on the sub-processor that you performed on the processor. The regulator reads the chain, not just the first link.
Frequently asked questions
Does the controller have to approve every sub-processor individually?+
Not if the DPA provides general authorisation — the controller can be given a right to object instead. If no general authorisation exists, specific authorisation is required for each new sub-processor.
What's a sub-processor change clause?+
The DPA clause that gives the controller advance notice of new sub-processors and a right to object. Typical notice is 30 days; typical remedy on objection is to terminate the affected service.
Who is liable for a sub-processor breach?+
The processor is fully liable to the controller (Article 28(4)). The controller remains primarily accountable to data subjects. Direct action against the sub-processor is possible under Article 82 but is rare.
Related terms
Data Processor
An entity that processes personal data on behalf of and under the instructions of a Data Controller.
Data Controller
An entity that determines the purposes and means of processing personal data.
Standard Contractual Clauses
Pre-approved contract clauses issued by the European Commission for lawfully transferring personal data outside the EEA.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes