When the outsourcing provider subcontracts abroad: what to do first
When your outsourcing provider adds a subcontractor abroad, the first step is to read the contract's assignment and sub-processing clause, not the subcontractor's own terms. If the clause requires your prior written consent, the clock for objecting starts on notice. If the contract is silent on subcontracting, the provider stays fully liable for the subcontractor's performance, but the security and data-flow risk still needs mapping before you sign anything off.
What the contract actually triggers
Two separate questions tend to sit inside one notice, and they run on different logic. Directive (EU) 2022/2555 (NIS2) requires in-scope entities to manage supply-chain and third-party cybersecurity risk, and a subcontractor performing outsourced functions falls inside that scope. Directive 2009/24/EC governs the legal protection of the software itself: sub-licensing, decompilation, and access to source code by a subcontractor are questions this directive frames, not the outsourcing contract alone.
Neither directive tells you whether to consent. Both tell you what to check before you do.
What changes in practice
The NIS2-driven risk question starts the day the subcontractor is proposed, not on go-live. It asks what the subcontractor can reach, and how that reach is monitored and reported back to you. The software-protection question under Directive 2009/24/EC becomes live only once the subcontractor receives source code, object code, or modification rights — access, not location, is what triggers it. Where the licence terms are partly expressed in code rather than text, the mismatch described in When a smart contract conflicts with the written licence can surface inside a subcontracting chain too.
What to do, in order
| Step | Who does it | Typical timing |
|---|---|---|
| Pull the assignment and sub-processing clause, and the schedule of permitted locations | Contract owner on your side | Before responding to the notice |
| Check whether the notice carries a consent right or only an information right | Legal or procurement lead | Within the notice period stated in the contract |
| Map what data and what code the subcontractor will actually touch | Technical lead with legal | Before consent is given |
| Request the subcontractor's security posture and location in writing | Vendor manager | Same window as the consent check |
| Decide: consent, object, or negotiate a carve-out | Person holding sign-off authority | Before the notice period lapses |
| Record the decision and the reasoning in the vendor file | Contract owner | Immediately after the decision |
Who decides
The decision sits with whoever holds contractual sign-off authority for vendor changes, not with the outsourcing provider. If the provider treats silence as consent, check the contract's default rule before assuming that reading is correct. Where the contract allows escalation, it goes to the person named in the escalation clause, not to a court at this stage.
If your situation differs
If the subcontractor sits inside the EU, location itself changes little beyond the usual due diligence on security and access. If the subcontractor sits outside the EU, check the transfer mechanism named in the data processing terms before consenting — a subcontractor abroad does not remove that requirement, it adds it. If the contract has no sub-processing clause at all, the provider still stays liable for the subcontractor's performance, but the missing clause removes your objection right, not the underlying risk.
What this page does not cover
This page does not decide whether a specific subcontractor is acceptable, and it does not replace a review of the subcontract itself. It also does not cover a live incident where a subcontractor has already accessed data or code without notice — that is a different situation with its own first step. If personal data sits inside what the subcontractor accesses, individual rights may apply on a separate track; see If you are named in a report explained.
Verified
Verified against current EU sources on the date shown at the bottom of this page. Primary references used above: Directive (EU) 2022/2555 (NIS2); Directive 2009/24/EC. Where the counterparty behind the subcontractor needs checking against a public record, see Counterparty in Estonia and its limits step by step.
Where the subcontract or licence document itself needs a similar check, see Document in Estonia and its limits in practice.
Related situations
Once the subcontractor is live, the next question is usually about service levels rather than the subcontractor itself. When an SLA credit regime is triggered step by covers that neighbouring situation.
FAQ
What is the first step when the outsourcing provider subcontracts abroad?
Read the assignment and sub-processing clause before responding, and check whether it gives you a consent right or only an information right.
Which deadline is already running?
If consent is required, the clock starts on the notice date, not on your internal review timeline. If the contract is silent, no consent clock runs, but the underlying risk still needs mapping.
Who decides, and on what evidence?
The person holding contractual sign-off authority for vendor changes decides, based on the subcontractor's security posture, location, and the scope of data or code access — not on the provider's assurance alone.
If a subcontracting notice has already arrived, treat the clock as running from receipt, not from the day your internal review happens to start.