When personal data flows to a new subprocessor: what to do first

A new subprocessor changes the risk map the moment a data flow starts, not when the contract is signed. Confirm the flow's legal basis, check whether the subprocessor is already disclosed on the authorised list, and close any missing safeguard in writing before the transfer runs live. Auditing the arrangement after the fact is the wrong order, and it is the order most files fall into.

What triggers the review

The trigger is not the master service agreement. It is the moment the subprocessor begins to receive, store or process the data on the controller's behalf. Two EU instruments can attach to that moment, depending on what the subprocessor actually does with the flow.

Where the subprocessor operates as part of a networked or ICT service, and the operator introducing it already falls within scope, the supply-chain risk-management duties set by Directive (EU) 2022/2555 (NIS2) apply. Adding a subprocessor is exactly the kind of supply-chain event those duties are built to cover.

What changes once the flow starts

Three things change once the flow is live. The contractual chain gains a new link that must carry the same safeguards as the original one. The vendor file must show the subprocessor was checked before onboarding, not after. And any incident at the subprocessor now sits inside the notification clock the controller already runs — the clock does not restart, it simply inherits the new party.

What to do first

1. Data protection or compliance lead pulls the current subprocessor list and confirms whether the new party is already disclosed to the counterparty.
2. Contract owner checks the master agreement's subprocessing clause for a notice period and an objection right, and calendars the deadline.
3. Technology counsel reviews the subprocessor's own contract for equivalent safeguards on deletion, security and further subprocessing.
4. Security lead requests the subprocessor's technical measures before the first transfer, not after it.
5. Contract owner records the check and the sign-off date in the vendor file.
6. If the notice period has run without objection, the file closes; if it has not, the objection window becomes the priority.

Who decides, and on what evidence

Internal sign-off sits with whoever holds authority over vendor onboarding under the controller's own governance — see Who signs the work for how that authority is assigned inside a file. Where a dispute over the subprocessor's compliance reaches a supervisory forum, the decision rests with the relevant data protection authority or, on a cybersecurity risk-management question, the competent NIS2 authority in the operator's member state. The evidence is the vendor file itself: the notice, the objection window, the safeguard clause and the dated sign-off.

If the situation differs

If the subprocessor's role is limited to hosting with no analytics or AI layer, the check stops at the subprocessing clause and the security questionnaire.

If the subprocessor runs the data through an AI system to generate outputs, obligations on the deploying party under Regulation (EU) 2024/1689 (AI Act) may start to run on top of the subprocessing check. The two clocks are separate and do not offset each other.

If the subprocessor supplies a licensed software component as part of the service, that component's protection sits under Directive 2009/24/EC, and the subprocessing clause needs to address the software licence separately from the data safeguard.

If the arrangement also assigns or licenses tokenised rights over the data or its outputs, the provenance question is a different kind of check — see When the token refers to an unregistered right for that path.

What this page does not cover

This page does not certify a subprocessor as compliant, and it does not draft the subprocessing clause. It answers what to do first, not what a full audit would later show.

Where the new subprocessor is itself the counterparty under review, the underlying question shifts to what can actually be established about it — Counterparty in Netherlands and its limits in detail sets out that boundary for a Dutch entity.

Where the open question concerns one document in the chain — a certificate, a filing, a registration — Document in Netherlands and what to prepare covers what a document check can and cannot confirm.

Verified

Verified as of 4 June 2025. Primary sources: Directive (EU) 2022/2555 (NIS2), applicable in member states from 18 October 2024; Regulation (EU) 2024/1689 (AI Act), in force from 2 August 2026; Directive 2009/24/EC, in force since 25 May 2009, where the subprocessor's role includes licensed software.

Related situations

A related situation covers the adjacent case where the vendor's own infrastructure moves rather than a new subprocessor being added — When a hosting provider changes region and the deadline.

Frequently asked questions

What is the first step when personal data flows to a new subprocessor?

Confirm whether the subprocessor is already disclosed, then check the notice and objection window in the master agreement before the transfer runs live.

Which deadline is already running?

The notice period set in the subprocessing clause of the master agreement. It starts when the operator is notified of the new subprocessor, not when the data actually starts flowing.

Who decides, and on what evidence?

Internal sign-off sits with whoever holds vendor-onboarding authority under the controller's own governance. Where a dispute reaches a supervisory forum, the relevant data protection authority or the competent NIS2 authority decides, on the evidence in the vendor file.

— Rasa Tumenaite, AURELIS