Explainer · sub-processor changes
What is a sub-processor?
A company your vendor hands your data to.
Precisely: a company your vendor brings in to process personal data you handed to the vendor. Use an AI vendor, and its cloud host, its model provider and its support tools can each be one.
The law is quoted from the official text. Every vendor clause is from an agreement we read on the date shown, with a fingerprint (SHA-256 hash) of the dated copy we kept.
The law
What does the GDPR say?
The GDPR doesn’t use the word. It says “another processor”, and sets two rules.
Your vendor needs your authorization.
GDPR Article 28(2)
The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.
The sub-processor takes on the same obligations.
GDPR Article 28(4)
Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, …
Authorization
There are two ways you can authorize a sub-processor.
The standard contractual clauses, the EU’s template for sending personal data outside the EU, spell out both.
Specific
The vendor asks each time.
Standard contractual clauses, Clause 9(a), Module Two, Option 1
OPTION 1: SPECIFIC PRIOR AUTHORISATION The data importer shall not sub-contract any of its processing activities performed on behalf of the data exporter under these Clauses to a sub-processor without the data exporter’s prior specific written authorisation. The data importer shall submit the request for specific authorisation at least [Specify time period] prior to the engagement of the sub-processor, together with the information necessary to enable the data exporter to decide on the authorisation.
General
The vendor works from an agreed list and tells you before it changes.
Standard contractual clauses, Clause 9(a), Module Two, Option 2
OPTION 2: GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least [Specify time period] in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).
Both leave the period blank, for the parties to fill in. Vendors fill it in their own data processing agreements (DPAs). The standard contractual clauses have their own page.
Standard contractual clauses, Clause 9(b), Module Two
Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects.
The list
Some vendors give notice by editing a web page.
Under general authorization, the agreed list is often a page on the vendor’s own site; we can read 122 of them. Some agreements treat an edit to that page as the notice itself.
Vespa
10days (see the clause)
At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List. The Customer may object to such an engagement by informing Vespa.ai within this ten (10) day period, provided such objection is in writing and based on reasonable grounds relating to data protection.
read November 11, 2026 · fingerprint 8d933ed9ec5c
Where notice is a page rather than an email, nothing arrives in anyone’s inbox. The page changes and the clock starts. What the notice clause obliges you to do covers this in detail.
The window
How long do you have to object?
We quote the window from 81 AI vendors’ clauses. 55 give you a period to object once told; 21 state a notice period before the change rather than a time to object.
The shortest: 5 days to object
Business days and calendar days both appear, and they are not the same clock.
Anyscale
5days to object
(d) Customer may object in writing to Anyscale's appointment of a new Subprocessor based on reasonable data protection concerns by emailing [email address on the vendor's page] within five (5) calendar days of notice of a new Subprocessor from Anyscale and the parties will discuss such concerns in good faith.
read November 11, 2026 · fingerprint 648fa87823b9
Airtable
10business days to object
Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.
read November 4, 2026 · fingerprint 96a00752c7a8
Every window we hold is listed with the vendor’s own sentence, its source and the date we read it.
How often do the lists move?
sub-processor lists we can read, for the 186 vendors we watch
vendors whose list page has differed from our previous copy
of those, where a name was added or removed
Each change is published on what changed 30 days after we record it; subscribers are told the morning we read it.
The free scan reads your own sub-processor page and shows the window each listed vendor gives you.
Common questions.
- What is a sub-processor?
- A company that a processor (your vendor) engages to carry out processing of personal data on behalf of the controller (you). The GDPR describes it in Article 28(2) and 28(4) as "another processor"; the standard contractual clauses call it a sub-processor.
- Does a vendor need permission to add a sub-processor?
- Under GDPR Article 28(2), a processor may not engage another processor without the controller's prior specific or general written authorization. Under general authorization it must inform the controller of intended additions or replacements, giving it the opportunity to object.
- What is a sub-processor list?
- The list of sub-processors a vendor uses. AI vendors publish them as pages on their own sites, and Xither reads them for the vendors it watches. Under general authorization, a change to that list is what the controller is told about and can object to.
- How long do I have to object to a new sub-processor?
- It depends on the vendor's DPA. The standard contractual clauses leave the period blank for the parties to fill in ("at least [Specify time period]"). Xither quotes the period from each AI vendor agreement it holds on its notice windows page.
- What is the difference between a processor and a sub-processor?
- The processor is the vendor you contracted with. A sub-processor is a company that vendor engages. GDPR Article 28(4) requires the same data protection obligations to be imposed on the sub-processor by contract.
Not legal advice.
This page quotes the law and published agreements on the dates shown. A negotiated contract may say something else, and it governs.
Xither Staff Writer · reviewed September 30, 2026. Vendor clauses and counts are generated from the record when the page is served.
Hear the morning we read a change to your vendor’s sub-processor list or DPA.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.
Try it free for 14 daysNo card. Nothing to cancel.