Subprocessor approval process: documents to prepare
A subprocessor approval process moves fast only when the requesting side sends a complete file at once. In practice this means five to seven documents: the subprocessor's registration details, a security questionnaire response, the updated processing description, the notice text required by the main contract, and a record of any prior objections. Missing one document restarts the clock rather than pausing it.
This page sets out the stages, the paperwork for each stage, and the point after which withdrawal becomes difficult. It sits inside our wider Technology contracts and outsourcing in practice coverage and pairs with the situation page on what happens when the outsourcing provider subcontracts abroad and the deadline for objection starts running.
What starts the process
Most technology contracts treat subprocessor approval as a notice-and-objection mechanism, not a request-and-consent mechanism. The provider notifies; the customer has a fixed window to object; silence usually counts as approval. The documents below are what a customer's legal or procurement team needs on the table before that window opens, and what a provider needs ready before sending the notice.
| Stage | Document | Prepared by | Typical timing |
|---|---|---|---|
| Notice | Subprocessor notification letter, naming the entity and its role | Provider | Before the subprocessor starts processing |
| Notice | Updated list of processing locations and functions | Provider | Attached to the notice |
| Review | Security questionnaire or completed due diligence form | Subprocessor, via provider | Within the objection window |
| Review | Data flow diagram showing what data reaches the new party | Provider or joint | Within the objection window |
| Objection | Written objection or reasoned refusal | Customer | Before the window closes |
| Resolution | Remediation plan or replacement proposal | Provider | After a sustained objection |
| Closure | Confirmation of approval or termination notice | Customer or provider | At window close or after remediation |
Practical consequence
The main risk is not refusal. It is silence treated as consent. If the objection window is short and the customer's internal review is slow, approval happens by default before anyone has actually reviewed the security questionnaire. Teams that miss this deadline lose their strongest lever: refusing before the subprocessor starts work is far easier than unwinding an arrangement afterwards.
A second consequence concerns evidence. If a dispute arises later about whether proper notice was given, the file that matters is the notice document itself, the date it was sent, and any read receipt or acknowledgement. Verbal or informal notice rarely satisfies a written-notice clause, even where the relationship is otherwise cooperative.
What to do
- Assign one internal owner to track the objection window from the date of notice, not the date the email was read.
- Request the security questionnaire and data flow diagram immediately, rather than waiting for the objection deadline to approach.
- Circulate the notice to legal, security and the business owner in parallel, not in sequence.
- Draft a written objection template in advance, so a genuine concern does not miss the deadline while wording is agreed internally.
- Log the date of receipt, the date of any response, and the date the window closes, in a single place accessible to all reviewers.
- If approval is granted, confirm it in writing even where the contract treats silence as sufficient.
Who decides
The decision sits with the customer's contract owner, not with a court or regulator, unless the dispute escalates to termination. Most contracts place the review with whichever function signed the original agreement, typically procurement or legal, sometimes with a security sign-off gate. The objection window is set by the contract clause itself; there is no external statutory deadline that overrides it. Escalation, where the contract allows it, usually runs to a named senior contact before either side considers termination.
Forks
If the subprocessor sits outside the customer's home region, the review should extend to where the data physically moves, not only to who processes it. If the objection window has already closed and the customer only now has concerns, the remaining lever is usually a service-level or audit clause rather than the approval mechanism itself. If the provider fails to respond to a sustained objection within the contractual period, most agreements treat this as a right to suspend payment or terminate for the affected service, not as automatic approval.
Sources and limits
This page describes a contractual procedure, not a statutory one. It does not set out the underlying rules on subcontracting of intellectual property rights, on cybersecurity obligations for the subprocessor's own systems, or on artificial intelligence components the subprocessor may run — those questions depend on the specific technology involved and the parties' home jurisdictions, and sit outside this procedural guide. Where the underlying question concerns what a due diligence file can actually establish about a counterparty or a document, our report pages set out the limits directly: see Counterparty in Germany and its limits in practice and Document in United Arab Emirates explained.
This page does not cover pricing of the approval review, does not name a specific jurisdiction's court procedure for a contested refusal, and does not replace the actual notice clause in your contract, which always controls over general description.
Verified
Last checked: current publication date. This page describes a standard contractual mechanism found across technology and outsourcing agreements; it does not rely on a specific statutory citation, and none is required for a procedural description of this kind. Our approach to collecting and dating source material is described in full at Methodology: collection, cross-checking and dating and the evidence.
Frequently asked questions
How long does subprocessor approval process take in practice?
The objection window is set by the contract, commonly between fifteen and thirty days from notice. Internal review inside that window typically takes far less time when the security questionnaire is requested immediately rather than near the deadline.
Which documents are needed to start?
At minimum: the notice itself, an updated list of processing locations, and a security questionnaire response. A data flow diagram is strongly advisable even where the contract does not require one.
What happens if the other side does not respond?
If the customer stays silent through the window, most contracts treat this as approval. If the provider stays silent after a sustained objection, most contracts allow suspension or termination of the affected service rather than automatic approval.
Related publications
See also Service credit calculation: documents to prepare for the parallel procedure that applies once a service level is missed rather than a subprocessor added.
Next steps
If a subprocessor notice has already been sent and the review window is running, read What to do first in this situation in detail for the immediate sequence of actions. If the concern is a subcontractor working from outside the expected jurisdiction, the relevant next step is When the outsourcing provider subcontracts abroad and the deadline.