Subprocessor

Q: Do I need to notify customers when adding a new subprocessor?

Under GDPR and most enterprise DPAs, yes. You must provide advance notice (typically 30 days) before adding a new subprocessor. Some contracts give customers the right to object to new subprocessors.

ClauseOps

A subprocessor is a third party engaged by a data processor to assist in processing personal data on behalf of the data controller. In the SaaS world, your cloud provider (AWS, GCP, Azure), your database provider, your email service, and any other vendor that touches customer data is a…