Sub-processor

A sub-processor is engaged by a processor, not by the controller directly. Cloud hosting, database services, e-mail providers, payment processors, messaging platforms and AI extraction services are typical examples for a software product. Under GDPR the processor needs the controller's prior authorisation, which is usually given in general terms in the data processing agreement together with a right to object to changes.

The processor must impose the same data protection obligations on each sub-processor by contract and remains fully liable to the controller for their performance. Where a sub-processor is located outside the EEA, a transfer mechanism such as the EU-US Data Privacy Framework or standard contractual clauses is required. Publishing an up-to-date sub-processor list with the purpose and location of each provider, and notifying changes in advance, is the accepted way to meet the transparency requirement. Kontevia publishes such a list and notifies users before adding a provider.