Subprocessor approval process: stages and deadlines
A subprocessor approval request usually moves through four stages: notice, review, objection window, and confirmation. In a functioning technology contract the whole cycle takes two to six weeks. The clock starts when the customer receives a complete notice, not when the supplier sends an incomplete one.
The stakes are ordinary but real. A missed deadline on either side does not void the contract, but it does shift who carries the risk if the subprocessor later causes a problem. Getting the sequence right matters more than getting it fast.
What starts the clock
The process begins the moment a supplier tells the customer it intends to use a new subprocessor for the contracted service. A notice counts as complete only when it names the subprocessor, states the function it performs, and states where the processing happens. An email that says "we are adding a new vendor" without those three points does not start any deadline.
Most contracts route the notice to a named contract owner on the customer side, not to a general mailbox. If the notice lands in the wrong inbox, the supplier carries the risk. The burden of proof that notice was given properly sits with the sender, not the recipient.
Notice sent after the subprocessor has already started work is not a defect that a contract can simply overlook. It changes the character of the whole process, which the forks below cover separately.
Stages and typical deadlines
| Stage | Who acts | Typical timing |
|---|---|---|
| Notice | Supplier | Before the subprocessor starts work, per the notice period set in the contract |
| Internal review | Customer's contract owner and security contact | Ten to fifteen business days from a complete notice |
| Objection window | Customer | Closes automatically if no written objection arrives before the deadline |
| Confirmation and record update | Both parties | Approval recorded in writing; subprocessor list updated within days, not weeks |
The point of no return sits between review and confirmation. Once the objection window closes without a written objection, most contracts treat the subprocessor as approved by default. A late objection after that point carries far less weight than one raised on time, and some contracts stop accepting it entirely.
What to do at each stage
- Supplier: send the notice in the form and to the address the contract names, with the three required facts included from the start.
- Customer's contract owner: log the date of receipt on the day the notice arrives, not later, since that date fixes every deadline that follows.
- Customer's security contact: run the internal review against the existing subprocessor risk criteria, not against a new checklist invented for the occasion.
- Customer's contract owner: send a written objection before the deadline if the review raises a genuine concern, and state the concern in writing.
- Both parties: confirm the outcome in writing and update the subprocessor list on the same day the confirmation is reached.
- Supplier: keep the confirmation on file; it is the only document that proves the subprocessor was approved, not merely notified.
Who decides and where a dispute goes
Approval is a contractual decision, not a regulatory one. The deciding role is whichever person the contract names as contract owner on the customer side, and that person's decision is final unless the contract gives someone else the right to override it.
In larger organisations, procurement often runs the paperwork while legal or security signs off on the substance. When those two functions disagree internally, the deadline does not pause. The customer still has to answer within the review window, even if the internal disagreement is not resolved by then.
Some technology stacks keep the confirmation record on a shared ledger rather than in an email thread. The same evidentiary question applies here as with On-chain record tokenised rights explained step by step. A record only counts as proof of approval if it ties to a date and a named decision-maker.
If the parties cannot agree, the dispute goes wherever the contract sends disputes generally. This page does not restate that forum; it is the same clause that governs any other disagreement under the same contract.
Common forks
If the customer never replies within the review window, most contracts treat silence as approval once the deadline passes. Read the exact wording before relying on this, because a small number of contracts reverse the default and require an affirmative confirmation instead.
If the supplier adds the subprocessor before sending notice, the approval process runs in reverse. The customer then reviews an existing fact rather than a proposal. The objection carries the weight of a breach notice, not a routine comment.
If the subprocessor sits outside the country or region the contract names as acceptable, the review usually stops at that point. Location is typically treated as a threshold question, checked before the rest of the review starts.
If the customer objects but the supplier disagrees with the reasoning, most contracts require a good-faith discussion before either side can treat the disagreement as a breach. Skipping that step weakens either party's later position.
What this page does not cover
This page describes the mechanics of the approval cycle only. It does not price the review, and it does not judge whether a specific counterparty is safe to bring into the chain as a subprocessor. Counterparty report before onboarding a distributor covers that separate question, for cases where the subprocessor is also a distributor of the underlying product.
It also does not verify whether the certificates or audit summaries a subprocessor submits are genuine documents rather than generated ones. Document report when a scan looks generated explained covers that check on its own track.
Data subject requests that arrive during the same period sit on a different track entirely. If you are named in a report overview explained sets out how that separate process runs, and it should not be merged into the subprocessor file.
Verified
Reviewed as of the publication date shown on this page. The stages above reflect common drafting patterns in technology and outsourcing contracts governed from Lithuania and Estonia. They describe contractual mechanics agreed between parties, not a statutory procedure, so no statute or regulation number applies to any deadline stated here. Always check the exact wording of the contract in front of you before treating any timing above as fixed.
Related reading
A comparable notice-and-response pattern governs service credits. Service credit calculation technology contract walks through that separate cycle stage by stage, and the same discipline around dates and written records applies there too.
FAQ
How long does subprocessor approval process take in practice?
Two to six weeks from a complete notice to a recorded confirmation, assuming no objection is raised. A genuine objection resets the clock, because the parties then negotiate a remedy instead of confirming a default approval.
Which documents are needed to start?
The notice itself, the subprocessor's stated function and location, and whatever security summary the contract requires as a condition of review. Without those three, the review has nothing to assess and cannot begin.
What happens if the other side does not respond?
Under most contracts, silence past the objection deadline counts as approval. Confirm the exact wording in your own contract, since a minority of templates require an explicit sign-off instead of treating silence as consent.
Next step
Two situations often follow directly after an approval decision. When the contract term outlives the product and its underlying service is discontinued mid-term. When security duties reach you as a supplier and the obligations move downstream to the party that approved the chain in the first place.