Sub-Processors
Also called: Sub-Processor Clause · Third-Party Processors
A sub-processor clause governs whether and how a data processor can delegate data-processing activities to a third party — such as a cloud host, analytics tool, or support platform. It determines how much visibility and control a customer retains over who actually touches their data.
In more detail
Almost no modern software product processes data entirely in-house — hosting, email delivery, analytics, and customer support tools are typically third-party services. Each one that touches personal data is a sub-processor, and most data-protection regimes require the customer to have visibility into who they are.
The strongest version of this clause requires the processor to maintain a current, accessible list of sub-processors and to notify the customer before adding a new one, with a right to object. A weaker version allows sub-processor changes silently, which is where most real risk in this clause sits.
The head processor typically remains liable for a sub-processor's failures under most data-protection frameworks — but that doesn't reduce the customer's practical interest in knowing exactly who has access to their data and under what safeguards.
A SaaS provider adds a new customer-support tool that stores ticket data, including customer personal information, without notifying customers. Under a well-drafted sub-processor clause, this would require advance notice and give affected customers a right to object.
GDPR-style regimes have specific, codified requirements around sub-processor authorisation and notice; other data-protection frameworks are less prescriptive. What "adequate" sub-processor governance looks like depends on which regime actually applies.
What our lawyers check
- Whether a current sub-processor list exists and is accessible
- Whether new sub-processors require advance notice, and whether customers can object
- What data-protection safeguards flow down to sub-processors contractually
- Whether the head processor remains liable for sub-processor failures
Contracts where this clause matters
Related terms
This definition is general information about commercial contracting practice, not legal advice. How a clause operates depends on the specific wording of your agreement and the law that governs it. For advice on your contract, have it reviewed by a lawyer.
All glossary terms