What a subprocessor list contains
- Name. The legal or trading name of each subprocessor.
- What they do. Hosting, email delivery, support tooling — the purpose of the processing.
- Where. The country or region the processing happens in.
Keep it current without extra work
Lists go stale when they are maintained separately from supplier onboarding. The reliable approach is to mark, on each supplier’s record, whether it processes personal data for you — and publish the list from those records, so onboarding or offboarding a supplier updates it.
Only active suppliers should appear. A supplier still being assessed is not yet a subprocessor, and one you have offboarded no longer is.
Show what matters, not everything you know
Your assessment of each supplier — its risk rating, contract value, screening results — is your private judgement and should not appear on a public list. Name, purpose and location are what customers need.
Common questions
- Do we have to notify customers of changes?
- Many data processing agreements require notice before a new subprocessor is used. Check your contracts; a published list makes the notice easier to give.
- Is every supplier a subprocessor?
- No — only those that process personal data on your customers’ behalf. Your office cleaner is a supplier; your cloud host is a subprocessor.
In RegulaTrust each supplier record says whether it processes personal data for you. If you choose to publish your subprocessor list, your trust centre builds it from active suppliers marked that way, showing only name, category and country — never ratings, contract values or screening results.
Get early accessGeneral information, not legal advice. Check the obligations that apply to your firm with a qualified adviser.