What is a subprocessor?

A subprocessor is a company that your vendor uses to process your personal data. If you buy a SaaS product, the vendor is your processor; its cloud host, its email delivery service and its AI model provider are typically its subprocessors.

What GDPR requires

Article 28 of the GDPR sets two main rules:

• Authorization. A processor "shall not engage another processor without prior specific or general written authorisation of the controller" (Art. 28(2)). With a general authorization, the processor must tell the customer about changes so it can object.
• Same obligations. The processor must impose "the same data protection obligations" on the subprocessor by contract (Art. 28(4)), and stays liable to the customer for the subprocessor's performance.

In practice, vendors publish a subprocessor list and promise in their DPA to give notice before adding a new one. PostHog's handbook, for example, says: "A list of sub-Processors is maintained as part of our DPA - we keep this to a strict minimum" (PostHog).

Why questionnaires ask about them

Your security is only as good as the companies you hand data to. Expect questions like "List all subprocessors with access to customer data," "Where is the data processed?" and "How do you assess your subprocessors?" Answer with the current list (name, purpose, location) and how you review them. If you use an AI model API, list its provider and say whether it can use your customers' data for training.