> For the complete documentation index, see [llms.txt](https://docs.assenteo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.assenteo.com/key-legislation/the-gdpr/subprocessors-and-vendors.md). # Subprocessors and Vendors ### Contents * [1. What is a subprocessor?](#id-1.-what-is-a-subprocessor) * [2. What is a vendor?](#id-2.-what-is-a-vendor) * [3. Disclosing your subprocessors](#id-3.-disclosing-your-subprocessors) * [What should you disclose about your subprocessors?](#what-should-you-disclose-about-your-subprocessors) * [4. Engaging a new subprocessor?](#id-4.-engaging-a-new-subprocessor) * [5. What can you do today to improve your approach to subprocessors?](#id-5.-what-can-you-do-today-to-improve-your-approach-to-subprocessors) ### 1. What is a subprocessor? A **subprocessor** is a third party that a data processor engages to help process personal data on behalf of the original data controller. Imagining your business is an SaaS startup, the data flow might look something like this: 1. Your business collects the name, email address and payment details of a new user. You are the data controller, deciding what data to collect and why (to bill the user). 2. Your business uses a cloud hosting provider to store your users’ personal data. The cloud hosting provider is acting on your instructions and so functions as the data processor. 3. The cloud hosting provider uses various third parties to help deliver its service. For example, it contracts a data monitoring service. This data monitoring service is still processing your business’s users’ personal data, but as a subprocessor. Importantly, your business remains responsible for these subprocessors’ data processing. You have obligations to carefully monitor the processing activities of your subprocessors. ### 2. What is a vendor? A vendor is any third party provider which provides goods or services to your business. Vendors which process the personal data for which your business is responsible are also [processors](/key-legislation/the-gdpr/what-is-data-processing.md)/ [subprocessors](/key-legislation/the-gdpr/subprocessors-and-vendors.md) under GDPR. Let us take the use of Motion, for instance. Motion is a vendor that your company may use for internal scheduling. * If your startup uses Motion for scheduling between team members, it is likely processing personal data such as employee names and email addresses. Your startup is the data controller, Motion is the data processor, and any third party Motion uses to assist with data processing is a **subprocessor** for your startup’s purposes. * If your startup uses Motion to schedule tasks which do not reference the names or personal data of any individuals, it is simply a **vendor**, not a data processor under GDPR. ### 3. Disclosing your subprocessors #### Internal disclosure Your business should keep **careful internal records** of processors and subprocessors linked to the business. This is for the **purpose** of: * **Regulatory compliance** * If your business decides to process any kind of personal data, it has obligations around ensuring the compliance of entities which help carry out that processing ([processors](/key-legislation/the-gdpr/what-is-data-processing.md) and [subprocessors](#id-1.-what-is-a-subprocessor)). * For example, you must only use processors that provide guarantees to implement certain technical and organisational data protection safeguards. * **Data location** * Your business may contractually only be able to process data in certain jurisdictions in which case it must be particularly attentive to the location of subprocessors. * **Security** * In case of data breaches, it is important to know the subprocessor will inform you within 72 hours of discovery and will cooperate with you on remediation. * They must also keep records of the incident which they can disclose to you. * These will help you conduct risk assessments and reduce security breach potential. #### Public disclosure Your business should also **publicly disclose** details of your processors and subprocessors on your website. This is for the **purpose** of: * **Regulatory compliance** * [GDPR](/key-legislation/the-gdpr.md) and other data protection regulations require disclosures of linked subprocessors to employees and users (as data subjects). * **Trust** * Publishing clear records of your subprocessors also constitutes part of your commitment to transparency and helps maintain trust from users and investors. #### What should you disclose about your subprocessors? * A list of all subprocessors your company is using to help process customer data and customer personal information * You should consider also answering the following questions for each subprocessor: * In which country does this processing take place? * What service does the subprocessor provide? (e.g. email deliverability metrics) * What type of data is processed (personal health information, personal information, customer data) * Confirmation of the typical notice period users can expect before changes to subprocessors and integrations take place (usually 30 to 60 days). ### 4. Engaging a new subprocessor? You must notify consumers in advance of any changes to the data flows e.g. additions of subprocessors. This is in order to give them the opportunity to object within a time period. If your business has a separate data controller (i.e., an outside party determines the purposes of your business’s processing), you must also inform this controller of any new subprocessors in order to give them the chance to object.
When you engage a new subprocessor, there may be a significant change to the flow of personal data; therefore, you must notify controllers, employees and users before processing begins.
### 5. What can you do today to improve your approach to subprocessors? * Make sure your business has clear internal records of the processors and subprocessors with access to the employee and user data you collect or process. * Ensure clear public disclosure of processors and subprocessors on your business’s website for users, investors and other potential stakeholders to consult. * Investigate appointing a [DPO](/privacy-professionals-when-do-you-need-them/when-do-you-need-a-dpo.md)/ [Privacy Partner](/privacy-professionals-when-do-you-need-them/when-do-you-need-a-privacy-partner.md). Having a DPO/ Privacy Partner on board can be really helpful for ensuring regulatory compliance with subprocessor obligations whilst easing the workload for your team. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.assenteo.com/key-legislation/the-gdpr/subprocessors-and-vendors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.