Do I have to tell my customers when my vendor adds a sub-processor?

It depends on your agreements with your customers, not on your agreement with the vendor. The duty usually sits in individual customer contracts, so the answer is often yes for some customers and no for others.

What should a sub-processor change notice say?

What changed, on whose page, on what date, and what your agreement with that customer provides. Quoting the added and removed lines lets them see the change instead of taking your word for it.

How long do I have to pass on a sub-processor notice?

Whatever your own customer agreements say, and they differ. The clock usually starts at your vendor's notice, not when you read it, so the day you find out is often not day zero.

How do I prove I sent notice in time?

Keep a dated copy of the vendor's page before and after the change, each with its fingerprint.

Free template · Customer notice

Your vendor changed its sub-processors. What do you tell your customers?

A sub-processor is a company your vendor hands your data to. If your contracts promise customers notice when that list changes, your vendor’s edit is now your deadline.

Here's the notice to send them, ready to copy.

A real one, unedited.

On October 28, 2026, we read a change to Zapier’s published sub-processor list. This is the notice Xither drafted.

As drafted, nothing about your contracts yet

Subject: Sub-processor change at Zapier

On 2026-10-28, Zapier updated its published list of sub-processors at https://zapier.com/legal/subprocessors.

Lines added to the published list:
  + Posted Date: October 27, 2026
  + Ndea | Artificial intelligence provider | USA |

Lines removed from the published list:
  - Posted Date: October 9, 2026

[Your company] uses Zapier as a sub-processor for [describe the processing]. We are notifying you of this change under [section] of our agreement. [If your agreement gives you a window to object, state it and the date it closes.]

A dated copy of the page before and after the change is held on our behalf by Xither (sha256 4d65f5c2cba5… → fe3002d4d8b3…) and is available on request.

With your customer agreements added

To: Northwind Health (MSA §11.4); Blackwell Bank (DPA Annex 3)
Subject: Sub-processor change at Zapier

On 2026-10-28, Zapier updated its published list of sub-processors at https://zapier.com/legal/subprocessors.

Lines added to the published list:
  + Posted Date: October 27, 2026
  + Ndea | Artificial intelligence provider | USA |

Lines removed from the published list:
  - Posted Date: October 9, 2026

[Your company] uses Zapier as a sub-processor for [describe the processing]. We are notifying you of this change under [section] of our agreement. Our agreement with you provides Northwind Health (MSA §11.4): 10 business days (by 2026-11-11); Blackwell Bank (DPA Annex 3): 30 days (by 2026-11-27).

A dated copy of the page before and after the change is held on our behalf by Xither (sha256 4d65f5c2cba5… → fe3002d4d8b3…) and is available on request.

Tell Xither what your customer agreements require and the notice names each customer and the date their window closes. The two customers on the right are invented for this page.

A draft, never sent by us.

In Xither it’s marked as a draft too. You decide what goes out, and to whom.

Zapier is the example because a sub-processor really moved on that reading. 71 recorded changes qualify under the same test our alerts use.

Before you send it.

01
Trim it.
The notice quotes every added and removed line. Vendor pages often change their navigation at the same time, so cut anything that isn't a sub-processor.
02
Pick who gets it.
The duty usually sits in individual agreements, not your standard terms. So it isn't everyone, and each contract has its own window.
03
Check if your clock has started.
It usually runs from your vendor's notice, not the day you read it.
04
Keep the proof.
A dated copy of the page before and after the change, each with its fingerprint, turns “we told you” into something you can show.

Not sure when each customer’s window closes? Work it out first with the notice worksheet.

Take the notice with you.

A Word file with both versions, in Xither's current wording on the day you open it.

Common questions.

Do I have to tell my customers when my vendor adds a sub-processor?: It depends on your agreements with your customers, not on your agreement with the vendor. The duty usually sits in individual customer contracts, so the answer is often yes for some customers and no for others.
What should a sub-processor change notice say?: What changed, on whose page, on what date, and what your agreement with that customer provides. Quoting the added and removed lines lets them see the change instead of taking your word for it.
How long do I have to pass on a sub-processor notice?: Whatever your own customer agreements say, and they differ. The clock usually starts at your vendor's notice, not when you read it, so the day you find out is often not day zero.
How do I prove I sent notice in time?: Keep a dated copy of the vendor's page before and after the change, each with its fingerprint.

Tell your customers

More for this job.

See every resource

This isn’t legal advice, and the notice is a draft, not wording anyone has approved for your situation. Whether you owe notice at all depends on your agreements with your customers. The vendor change quoted is a published page, read on the date shown. Corrections are free to request.