When a subprocessor is added mid-term: what it costs to be wrong
A notice that a subprocessor has been added mid-term is not paperwork to file and forget. It starts a contractual clock: an objection window written into the data processing agreement, not created by general law. Miss that window, and the addition counts as approved by silence. If the new subprocessor later mishandles the data, the record of who reviewed the notice — and when — becomes the only evidence that decides who carries the exposure.
The clock is contractual, not statutory
The right to review a new subprocessor and to object to it lives inside the processing agreement itself, not in a separate legal claim against the subprocessor. Most agreements use one of two mechanisms: specific authorisation, where every new subprocessor needs a signed approval before it goes live, or general authorisation, where the processor may add subprocessors freely subject to notice and a fixed objection window. The second model is far more common, and it is the one that catches organisations out, because the window runs whether or not anyone inside the business has actually read the notice.
Where the receiving organisation is an essential or important entity under Directive (EU) 2022/2555 (NIS2), the same notice also feeds a separate obligation: a supply-chain risk review of the new subprocessor's own security posture. That review runs on its own timeline, in parallel with the contractual objection window, and clearing one does not close the other.
What it costs to get this wrong
Getting this wrong rarely shows up immediately. It shows up later, when an incident traces back to a subprocessor nobody remembers approving, and the file has no record of who read the notice or why no objection was raised. At that point the question stops being "was the subprocessor adequate" and becomes "did we forfeit our right to object through our own silence" — a much harder position to argue from, because the contract's default rule usually resolves silence against the party that stayed quiet.
The second cost is procedural. An objection raised after the window closes, or raised informally by email instead of through the notice channel the contract specifies, is treated as no objection at all. The form of the response matters as much as its substance.
What changes once notice lands
Before the window opens, the customer holds real leverage: it can object outright, ask for an alternative subprocessor, or demand enhanced safeguards as a condition of acceptance. Once the window closes without a recorded objection, that leverage disappears for the remainder of the contract term, and any later dispute turns entirely on whether the objection procedure was followed to the letter the contract describes.
The same discipline applies to what the new subprocessor brings with it, not only to the notice itself. Confirm its contractual title to the infrastructure and tooling it will use before the window closes. When the deal transfers rights that were never owned sets out what happens when that check is skipped and the underlying rights turn out to belong to someone else.
What to do, in order
- Read the notice against the contract's own clause, not against general expectation. The data protection lead confirms the window's length and start date within one business day of receipt.
- Route the notice to whoever owns the vendor relationship — procurement or the data protection lead — so the deadline sits on one calendar, not scattered across several inboxes.
- Request the subprocessor's security and location details in writing before deciding whether to object. Verbal assurances from the existing processor do not survive a later audit.
- Escalate to legal if the change moves where data is processed, or introduces a new category of automated decision-making on that data.
- Record the decision — objection, acceptance, or conditional acceptance — in the vendor file, dated and signed by the manager who approved it, using the notice channel the contract names.
Who decides, and by when
| Question | Who decides | Typical timing |
|---|---|---|
| Whether to object to the subprocessor | The customer, under the contract's objection clause | Within the window stated in the agreement |
| Whether the subprocessor meets security requirements | The data protection lead, on the vendor's written assurances | Before the objection window closes |
| Whether the change triggers a supply-chain review | The organisation's own risk function, where NIS2 applies | Runs in parallel, on its own schedule |
| Whether an informal reply counts as an objection | The contract's notice-channel clause, not the reader's intent | Assessed at the moment the reply is sent |
| Whether silence is treated as consent | The contract's own default rule | Automatic, once the window lapses |
Three situations that change the answer
If the new subprocessor supplies AI-based processing — scoring, classification, or automated decisions applied to the data in scope — the review has to look past security and into what the output is used for. Once Regulation (EU) 2024/1689 (AI Act) applies to a given use, silence in the contract about that output stops being a minor gap. When the contract is silent on AI output explained sets out what that silence costs on its own.
If the subprocessor is separately accused of infringing a third party's rights in the tooling it uses to process the data, the customer's exposure does not wait for that dispute to resolve. Processing continues unless the contract lets it pause. A supplier is accused of infringing a third party walks through how that timeline runs and who carries the interim risk.
If the addition arrives alongside a corporate transaction — the subprocessor was just acquired, or the service was carved out and reassigned — check the assignment clause before assuming continuity of terms. The asset changing hands is different, but the underlying question is the same: who approved the change, and on what record. When a token is airdropped to existing users and shows that same question decided in a different asset class.
What this page does not decide
This page does not tell you whether a specific subprocessor is adequate for a specific processing operation. That turns on the vendor's actual security posture and its location, not on a general rule about notice windows.
It also does not calculate financial exposure if the subprocessor causes a breach after the window closes. That depends on the underlying incident and the indemnity clause negotiated for this particular contract, not on the notice mechanism described here.
Verified
Checked and current as of this page's publication. Primary references: Directive (EU) 2022/2555 (NIS2), in force from 18 October 2024, for organisations within its scope; Regulation (EU) 2024/1689 (AI Act), applying from 2 August 2026, where the subprocessor's function qualifies as an AI system. The contractual timing described above reflects standard processing-agreement drafting and is not itself a statutory deadline.
FAQ
What is the first step when a subprocessor is added mid-term?
Read the change notice against the contract's own clause and confirm the length and start date of the objection window, on the same day the notice arrives.
Which deadline is already running?
The objection window set out in the processing agreement. It starts on the date of notice, not on the date it is read, and silence at the end of it operates as consent under the contract's own default rule.
Who decides, and on what evidence?
The customer decides whether to object, based on the subprocessor's written security and location assurances, not on verbal reassurance from the existing processor.
Related situations
A different notice, the same discipline: When access requests arrive in volume: what it costs covers what happens when the clock that starts running belongs to a data subject, not to a vendor.
Talk to us
Send the change notice and the current processing agreement. We confirm the window, the escalation path, and the record you need before you reply — first response from a partner within minutes in business hours, and the fee confirmed within one business day.