A sub-processor is a company that a processor engages to carry out part of the processing it performs for a controller. For example, if your payroll provider stores your employee data with a cloud hosting company, that hosting company is a sub-processor.

What GDPR requires

GDPR and UK GDPR, Article 28(2): a processor must not engage another processor without the controller's prior specific or general written authorisation. Under a general authorisation, the processor must tell the controller about any intended additions or replacements so the controller can object.

Article 28(4): the processor must impose the same data protection obligations on the sub-processor by contract. If the sub-processor fails to meet them, the original processor remains fully liable to the controller.

Under POPIA, the equivalent relationship is between a responsible party and its operators, governed by sections 20 and 21.

What to check

  • A current, published sub-processor list, with locations and services
  • How the vendor notifies you of changes, and how long you have to object
  • How the vendor assesses its own sub-processors
  • Whether any sub-processors involve cross-border transfers

Sub-processors are often called fourth parties in third-party risk management.