Sub-processor is a third-party vendor engaged by your primary service provider (processor) to handle personal data as part of delivering their service to you.
Under GDPR Article 28, processors must:
- Notify the controller of any sub-processors they plan to use
- Obtain explicit controller approval before engaging a new sub-processor
- Ensure the sub-processor is bound by an equivalent DPA with the same data protection obligations
This creates a chain: Controller → Processor → Sub-processor, with each link requiring contractual protection.
For vendors like HDS hosters, sub-processor disclosures often become a critical compliance review item when they engage partners for hosting, backup, or analytics outside the European Economic Area.