What is a subprocessor?
A subprocessor is a third party that a data processor engages to process personal data on behalf of its customer, such as the cloud host or email service a software company uses to deliver its product.
Processor vs subprocessor
Under the GDPR, the controller decides why and how personal data is processed, and the processor handles it on the controller’s behalf. When the processor passes some of that work to another company, that company is a subprocessor. A software company is usually a processor for its customers’ data, and its hosting provider is its subprocessor.
Subprocessor examples
- Cloud hosting and storage providers.
- Email delivery and messaging services.
- Payment processors handling customer billing.
- Customer support platforms that store conversations.
- Analytics or error-tracking tools that receive personal data.
Subprocessor GDPR obligations
Article 28 says a processor may not engage another processor without the controller’s prior written authorisation, which can be specific or general. Under a general authorisation, the processor must tell the controller about intended additions or replacements, giving them the chance to object. The processor must pass the same data protection obligations down to the subprocessor and remains liable for its performance.
Keeping a subprocessor list
Most processors publish a subprocessor list showing what each one does and where it processes data, and offer subprocessor notification by email so customers hear about changes before they happen. Compliance as a Service for SMBs includes a GDPR control library that turns the regulation into a checklist of controls, each with the evidence that satisfies it.
Last reviewed 2026-11-01.