How to publish a subprocessor list
A subprocessor list is short to write and easy to let rot. Reviewers compare it with your SOC 2 report and your DPA, so the three have to agree.
Publish a subprocessor list as a dated table of every third party that processes customer personal data for you: its name, what it does, what data it handles and where it processes it. Offer a way to be notified of changes, and give the notice period your data processing agreement promises before adding a new one. Keep it consistent with your DPA and with the subservice organizations in your SOC 2 report.
What columns should the list have?
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Cloud provider | Hosting and storage | All customer data | Canada (Montreal, Calgary) |
| Email delivery service | Transactional email | Names, email addresses, message content | United States |
| Support desk | Customer support tickets | Contact details, ticket content | United States |
| Error monitoring | Application error tracking | Technical data, possibly user identifiers | Configured region |
| Last updated | Date of the last change | ||
How do we give notice of changes?
Offer an email sign-up for changes on the page, send notice before adding a new subprocessor as your DPA requires (thirty days is common, check yours), and keep a dated change history below the list. A managed trust centre sends those notices for you.
What goes wrong?
- Missing tools. Support desks, analytics and AI features are often forgotten.
- Vague locations. "Global" answers nothing. Name the region or country.
- Drift from the DPA. The list and the contract say different things.
- No date. An undated list is assumed stale.
Common questions
Do we need a subprocessor list if we have no GDPR customers?
Yes, in practice. Canadian buyers need it to meet their own PIPEDA or Law 25 obligations for information they send you, and US enterprise buyers ask for it in most reviews.
Is our cloud provider a subprocessor?
Yes, if it hosts customer personal data. List it with the regions you use.
Get your subprocessor list maintained
Kept current, with change notices, as part of a managed trust centre.
Get matched