In short
A subprocessor is a provider that a processor uses to process personal data on behalf of its customer, the controller.
What it means for you
Under the GDPR, a processor needs the controller's written authorisation before it brings in a subprocessor, and must pass on the same data protection obligations. Your data processing agreement says how that works and how you hear about changes.
Where to find it
In the data processing agreement, often with a list of current subprocessors or a link to one, and a clause on how new ones are added.
What to look for
- Whether the authorisation is specific or general
- How much notice you get of a new subprocessor, and whether you can object
- Where subprocessors process data, and the safeguards for transfers
How Gathersense helps
When you review a data processing agreement, Gathersense checks these clauses against your playbook. Our own subprocessors are listed by category on Trust and DPA.
