Skip to content
compliancebase

Sub-processor

A processor engaged by another processor to handle personal data for the controller’s service.

In practice

Keep a current subprocessor list, perform due diligence, flow down DPA terms, and operate notice or authorization mechanisms.

Common confusion

A subprocessor is defined by the processing chain, not simply by being any software vendor.

Related controls

Framework versions referenced in this page:

Last verified: August 2026 · Primary sources linked above