Subprocessor change alerts: get an email when a vendor's subprocessor list changes

Enter the address of a vendor's subprocessor list, privacy policy or DPA page. We read it once a day and email you a short summary when the text changes, so a new subprocessor does not slip past your objection period.

Published 7 October 2026 · Sources checked 7 October 2026

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Why subprocessor changes matter

When a university uses a cloud service to handle personal data, the vendor is usually a processor and the university the controller. Article 28(2) GDPR says the processor may not engage another processor (a subprocessor) without the controller's prior specific or general written authorisation. Most vendor contracts use general authorisation: you approve the current list, and the vendor must inform you of intended additions or replacements, "thereby giving the controller the opportunity to object" [1].

The EDPB explains why that notice matters. Under a general authorisation, the controller's failure to object within the agreed timeframe can be interpreted as authorisation [2]. In other words, a notice that nobody reads becomes a yes.

A new subprocessor can change your risk picture in several ways:

• International transfers. A provider outside the EU/EEA brings Chapter V GDPR into play, with an adequacy decision or safeguards such as standard contractual clauses [1]. Your records of processing and transfer assessments may need updating.
• New purposes. A newly listed AI model provider or analytics service can mean your data is used in new ways, which may affect your DPIA or the information given to students and staff.
• The chain of contracts. Article 28(4) requires the same data protection obligations to be imposed on each subprocessor, and the original processor stays fully liable for them [1]. You still have to decide whether the new company provides sufficient guarantees.

How much notice vendors give

The GDPR itself sets no number of days. The EDPB says the contract should state the timeframe for approval or objection, that it should be reasonable given the processing, and what happens after an objection [2]. The European Commission's standard contractual clauses for controllers and processors leave the period as a blank: the processor informs the controller of changes "at least [SPECIFY TIME PERIOD] in advance" [3].

Two published vendor DPAs, read on 7 October 2026, show how this is filled in in practice:

• Google Cloud (Cloud Data Processing Addendum): notice at least 30 days before a new subprocessor starts processing customer data, and the customer may object within 90 days of notice by terminating the agreement [4].
• Atlassian (Data Processing Addendum): notice at least 30 days before a new subprocessor processes customer personal data, sent to the email addresses that have subscribed to notifications [5].

Two practical points follow. First, an objection right often means ending the service, so the earlier you know, the more options you have, for example negotiating, changing configuration or planning an exit. Second, where notices go only to subscribed addresses, the right person at the university has to be subscribed, and stay subscribed when staff change. An independent alert does not replace the vendor's notice, but it is a cheap second line.

How to find a vendor's subprocessor list

1. Read the DPA. It usually links to the list or includes it as an annex. If the list is only in an annex of a signed PDF, ask the vendor where changes are published.
2. Look in the footer. Legal, Privacy, Trust or Security pages often link to "Subprocessors" or "Sub-processors". Atlassian and Google Cloud, for example, publish theirs as public web pages [5] [6].
3. Search the vendor's site for "subprocessors", "sub-processors" or "third parties", and check the trust centre if the vendor has one.
4. Ask the vendor. If nothing is published, ask for the list and for the notification method in writing. That answer belongs in your vendor assessment.

If the vendor offers its own notification sign-up, use it as well. Then paste the list's address into the form above.

What to do when an alert arrives

1. Open the page and confirm the change. The summary is written by AI and can miss nuance, so read the added and removed entries yourself.
2. Check your contract. Find the notice and objection period in your DPA and note the deadline. If you never received the vendor's own notice, ask why.
3. Assess the new company. Note its role, where it processes data, and whether a transfer outside the EU/EEA is involved. Ask the vendor for the safeguards in place.
4. Decide and record. Accept, ask questions or object in writing before the deadline, and update your records of processing and any DPIA that names the vendor.

How the alerts work

• We read the page when you sign up to make sure it is readable, then about once a day.
• When the text changes, an AI model summarises the added and removed lines. Changes the model judges to be layout or navigation noise are not emailed; changes it cannot classify are.
• You get at most one email per page every three days, so a page that changes daily does not flood your inbox.
• PDF documents are compared on their contents. Pages that load their text with scripts cannot be read; the form tells you if that is the case.
• Pages followed by several people are read once and shared, and are removed when the last subscriber leaves.

Validemic workspaces include the same change monitoring for all of a university's vendors and regulation texts, with the full text difference for each change and an in-app change feed.

Sources

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 28 and 44 to 46. EUR-Lex: eur-lex.europa.eu/eli/reg/2016/679/oj/eng. Retrieved 7 October 2026.
2. European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1, paragraphs 155 to 160. edpb.europa.eu. Retrieved 7 October 2026.
3. Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors, Clause 7.7(a). EUR-Lex: eur-lex.europa.eu/eli/dec_impl/2021/915/oj/eng. Retrieved 7 October 2026.
4. Google Cloud, Cloud Data Processing Addendum (Customers), section on subprocessors. cloud.google.com/terms/data-processing-addendum. Retrieved 7 October 2026.
5. Atlassian, Data Processing Addendum, and List of Data Subprocessors. atlassian.com/legal/data-processing-addendum, atlassian.com/legal/sub-processors. Retrieved 7 October 2026.
6. Google Cloud, Google Cloud Platform Subprocessors. cloud.google.com/terms/subprocessors. Retrieved 7 October 2026.

About this page

Legal text and vendor terms checked on 7 October 2026. Vendor examples show what those documents state on that date and apply to the named services only; other plans and products may have different terms. If you spot an error, please contact us and we will correct it.