Sub-Processor Clause
Definition
Sub-Processor Clause
A sub-processor clause is the provision inside a data processing agreement that controls whether, and on what terms, a provider may pass personal data on to its own suppliers. Nothing may be sub-contracted without authorisation from the controller.
Almost every outsourcing chain has one — cloud hosting, ticketing platforms, translation services, screening vendors and offshore affiliates all touch personal data on the provider’s behalf.
The clause decides two separate things. Whether the provider may appoint sub-processors at all, and what obligations must be imposed on them when it does — and the second half is where most agreements are thin.
Authorisation comes in two forms. Specific authorisation names each sub-processor individually; general authorisation permits appointments subject to notice and a right to object, which is the practical default in multi-supplier delivery.
Key takeaways
- A processor cannot engage a sub-processor without the controller’s written authorisation.
- General authorisation must carry a notice period and a genuine right to object.
- The same data protection obligations must be imposed on every sub-processor.
- The original processor stays fully liable for its sub-processors’ performance.
How it works
The clause states the authorisation model, lists any approved sub-processors, sets the notice period for changes, gives the controller a right to object, and requires equivalent obligations to be imposed down the chain.
The authorisation rule itself is short and absolute. Under Article 28, “The processor shall not engage another processor without prior specific or general written authorisation of the controller”.
Flow-down is equally explicit. The same article requires that “the same data protection obligations as set out in the contract or other legal act between the controller and the processor” be imposed on the sub-processor by contract.
The UK regulator restates the practical test plainly, noting that “A processor may not engage a sub-processor’s services without the controller’s prior specific or general written authorisation”.
| Clause element | Weak version | Strong version |
|---|---|---|
| Authorisation model | General, unrestricted | General, with a published list and notice |
| Notice of change | None, or after the fact | 30 days before the sub-processor starts |
| Right to object | Absent | Stated, with a defined consequence |
| Flow-down terms | “Equivalent obligations” | The same obligations, evidenced on request |
| Liability | Silent | Processor remains fully liable for the chain |
The right-to-object row is the one that decides whether the clause has any force — an objection right with no stated consequence leaves the controller expressing a view while the appointment proceeds anyway.
Examples
Sub-processor terms are tested whenever a provider changes its own supply chain, which happens more often than buyers expect. Four cases show how the clause behaves.
A bank approves a named list of four sub-processors and requires thirty days’ notice for additions. Its provider changes hosting vendor, notice is given, and diligence happens before go-live.
A retailer grants general authorisation with no notice requirement. It discovers during an audit that customer records have been processed offshore by a party it has never assessed.
An insurer objects to a proposed sub-processor and the contract gives it a right to terminate the affected service. The provider proposes an alternative rather than lose the work.
A healthcare buyer’s clause requires equivalent obligations but no evidence. The provider asserts compliance, the buyer cannot verify it, and the regulator asks for proof.
Related terms
Data protection obligations run through several instruments and down several layers of the supply chain. The entries below separate the whole agreement from the provisions inside it.
- GDPR outsourcing: how the regime applies across outsourced delivery generally.
- GDPR: the regulation that sets the authorisation and flow-down rules.
- Multi vendor outsourcing: arrangements that multiply the number of chains to control.
- Vendor management outsourcing: the function that maintains the approved sub-processor list.
- Cybersecurity outsourcing: the controls a sub-processor must demonstrate before approval.
- SOC 2 outsourcing: the attestation most often accepted as flow-down evidence.
- ePrivacy Regulation: the adjacent regime covering communications data in the same chains.
FAQ
How is this different from a data processing agreement?
A data processing agreement is the complete instrument agreed between controller and processor. The sub-processor clause is one provision within it, governing the processor’s own suppliers.
What is general authorisation?
Permission to appoint sub-processors without naming each one in advance, subject to notice and a right to object. It is the practical model for most multi-supplier delivery.
How much notice should a change require?
Thirty days is the common commercial setting, and it should run before the sub-processor begins processing rather than before the contract is signed.
What happens if the controller objects?
Whatever the clause specifies, which is why it must specify something. A right to terminate the affected service without penalty is the version with real force.
Who is liable if a sub-processor fails?
The original processor, in full. Appointing a sub-processor transfers work, never accountability to the controller.
Are affiliates treated as sub-processors?
Yes, where they process the data. A provider’s offshore group company is a separate legal entity and needs the same authorisation as any third party.
Compare providers who publish their sub-processor list in the Outsource Accelerator directory.
Independent
