When a subprocessor is added mid-term: what to do first

A new subprocessor added during the term of a processing agreement triggers a specific procedure, not a general review. Most agreements give the controller a fixed window to object once notified. Miss that window and the addition stands unchallenged. Act inside it and the right to refuse, escalate, or terminate the affected part of the service is preserved.

Basis

The right to object to a new subprocessor sits in the processing agreement itself, under the controller-processor rules that already govern the arrangement. Where the organisation falls within the scope of Directive (EU) 2022/2555 (NIS2) as an essential or important entity, the addition also triggers a supply-chain risk step. NIS2 requires in-scope entities to assess the cybersecurity practices of direct suppliers, and a new subprocessor brought into an existing chain falls squarely within that assessment.

If the new subprocessor operates an AI system as part of the processing, a separate layer applies once Regulation (EU) 2024/1689 (AI Act) is in force. That regulation enters into force from 2 August 2026, and the obligations it adds depend on how the AI system in question is classified.

Practical consequence

Three things change the moment notice of a new subprocessor arrives. The objection clock starts running, usually a short fixed period set out in the contract. The controller's audit and information rights extend to the new subprocessor from that date. Any transfer of data outside the original processing locations must also be checked against the safeguards the contract already relies on, before the objection window closes rather than after.

What to do

1. The contract owner records the date the notice was received. The window runs from that date, not from the date the notice was read.
2. The compliance lead checks the clause for the length of the objection period and the form the objection must take.
3. The security team assesses the new subprocessor's location, certifications, and any transfer implications, before the window closes.
4. Where the organisation is NIS2 in-scope, the compliance lead runs the supply-chain risk step for the new supplier in parallel, not after.
5. Where an objection is warranted, the contract owner sends it in the form the agreement requires and keeps proof of sending.
6. Legal counsel is looped in where the vendor declines to remove the subprocessor after a valid, timely objection.

Who decides

The controller decides whether to object, based on the risk assessment of the new subprocessor and the terms already agreed in the contract. Where the objection escalates into a contractual dispute, the forum is whatever the agreement names — arbitration, or the courts of the agreed jurisdiction. NIS2 supervision, where the organisation is in scope, sits with the national competent authority designated under Directive (EU) 2022/2555 (NIS2), not with the vendor and not with the controller alone.

Branches

If the objection window has already closed by the time the notice is reviewed, the practical question shifts from objection to mitigation: audit rights, contractual remedies, and the transfer safeguards already in place become the working tools, rather than a right to refuse that no longer exists.

If the new subprocessor operates an AI system as part of the processing, and the contract says nothing about how AI-generated output is treated, that gap tends to surface at the same time as the subprocessor question — see When the contract is silent on AI output and.

If the subprocessor was added because the vendor itself was acquired, or the contract was assigned to a new entity, chain-of-title questions can surface alongside the data protection ones — see When an assignment breaks the chain of title.

If the vendor disputes a valid objection and applies for urgent relief rather than negotiating, the procedure to follow differs from ordinary correspondence — see When an injunction application is served and the deadline.

If the underlying service also touches a digital-asset product, such as a token distributed to existing users, subprocessor mapping still follows the same objection procedure described above — see When a token is airdropped to existing users.

Limit

This page does not assess whether a specific subprocessor is fit for purpose, and it does not draft the objection notice itself. It does not cover contracts where the objection right was never included in the first place — that gap is a drafting issue, addressed before a subprocessor is ever added, not a procedural one to be solved after notice arrives.

Verified

Checked against Directive (EU) 2022/2555 (NIS2) and Regulation (EU) 2024/1689 (AI Act), current as at the review date noted on the site's methodology page. No case law is cited on this page because none applies to the general procedure described here.

Related publications

A related situation covers what happens when access requests arrive in volume rather than one at a time — see When access requests arrive in volume: what to do.

— Rasa Tumenaite, AURELIS

FAQ

What is the first step when a subprocessor is added mid-term?

Record the date the notice was received and locate the objection window set in the contract. That date, not the date the notice was read, starts the clock.

Which deadline is already running?

The objection period specified in the processing agreement begins on the date of notice. Where the organisation is in scope of Directive (EU) 2022/2555 (NIS2), the supply-chain risk assessment for the new supplier should start in parallel, not afterwards.

Who decides, and on what evidence?

The controller decides, based on the risk assessment of the new subprocessor and the safeguards already agreed in the contract. Where the decision is disputed, the forum is whatever the agreement names.