Sub-Processor Clauses in a DPA: What to Require From Vendors

Almost no modern SaaS vendor processes your data entirely in-house. Cloud hosting, email delivery, customer support tooling, analytics, all of these are frequently sub-processors sitting behind the vendor you actually signed a contract with. Your DPA’s sub-processor clause determines how much visibility and control you have over that chain.

General vs. specific authorization

• General authorization: the vendor can add new sub-processors without asking you first, but must notify you (usually via an email list or a published, updated sub-processor page) and give you a window to object, commonly 14 to 30 days.
• Specific authorization: the vendor must get your explicit sign-off before adding a new sub-processor. More protective, but heavier for both sides, and most vendors selling self-serve/mid-market products won’t offer it outside enterprise tiers.

For most small and mid-size businesses, general authorization with a working notification mechanism is a reasonable standard, the practical risk isn’t the authorization model itself, it’s a vendor that changes sub-processors silently with no notification at all.

What the clause should actually require

1. A current, accessible list of sub-processors, ideally a public page the vendor keeps updated, not something you have to request each time.
2. Advance notice of new sub-processors, with enough lead time to actually object or reassess before the change takes effect, not a notice sent after the fact.
3. A meaningful right to object, even if it’s just the ability to terminate the affected service without penalty if you’re not comfortable with a new sub-processor, rather than no recourse at all.
4. Flow-down obligations, the vendor must impose data protection obligations on its sub-processors that are at least as protective as what’s in your DPA with them. Without this, the chain of accountability breaks at the second link.
5. Vendor liability for sub-processor failures, the vendor you contracted with should remain responsible if a sub-processor mishandles your data, not point you toward a company you have no direct relationship with.

A practical review step

When reviewing a new vendor’s DPA, actually open their sub-processor page (or ask for the list if one isn’t published) and skim it for anything that changes your risk picture, a sub-processor based outside the EU/UK without its own valid transfer mechanism, for example, or one in a category of data you didn’t expect to be shared. This takes a few minutes and is one of the more overlooked steps in vendor due diligence.

The bottom line

A DPA that’s silent or vague on sub-processors isn’t protecting you from the actual risk, which often sits one or two vendors removed from the contract you signed. A clear notification mechanism, a real objection right, and flow-down obligations are what make the sub-processor clause worth more than the paper it’s printed on.

This guide is educational and not legal advice. For your specific vendor relationships, consult a privacy attorney.