Your SaaS provider changes a subprocessor. What should you do?

Suppose Jacob, Tim and Celina run a SaaS product for customer support. An external tool receives ticket content, names and email addresses. One day Jacob gets a notice: the vendor plans to add a company that will analyse tickets using AI. Their data processing agreement, or DPA, gives them 14 days to object.

Jacob intends to forward the email after the weekend. Celina checks the DPA while Tim works out which tickets the new company would receive. Their own customer contracts also need attention. A routine-looking product update has become a decision about the processing chain.

Under GDPR general written authorisation, a processor must inform the controller of intended additions or replacements of subprocessors and give it an opportunity to object. The agreement should make that opportunity workable. GDPR does not prescribe a universal 14-day or 30-day period, and an objection alone does not settle how the service will operate afterwards.

What this guide covers

In brief

• A subprocessor processes personal data further down a service’s processing chain. Not every subcontractor has that role.
• General authorisation requires notice of intended changes and a meaningful opportunity to object. Silently editing a web page is not active notification.
• Under general authorisation, no objection within the agreed period may be treated as authorisation. Under specific authorisation, silence does not replace approval.
• Agree what happens after an objection: clarification, a workable alternative or an appropriate end to processing and service provision.
• Subprocessor authorisation does not replace international-transfer assessment or permit unrestricted new uses of the data.

Start with the actual processing chain

Roles depend on the operations performed, rather than the vendor’s label. A controller determines the purposes and essential means of processing. A processor carries out processing on its behalf. When a processor entrusts relevant operations to another company, that company may be a subprocessor.

In the founders’ example, a business customer uses the SaaS to support its users. For the personal data in those tickets, the customer is the controller and the founders’ company processes on its behalf. The external tool and the company analysing tickets may form further links in that chain. Map the particular operations: the same organisations can have different roles for billing data or their own analytics.

An office-stationery supplier does not become a subprocessor simply because it is a contractor. A remote-support company processing customer personal data may qualify even without hosting the main database. Tim needs to check the proposed tasks, access and data flows rather than rely on a description such as “technical services”.

GDPR Article 28(2) requires prior specific or general written authorisation from the controller before another processor is engaged. This is authorisation within the processing chain, distinct from an individual’s consent as a basis for processing their personal data.

Does doing nothing amount to approval?

It depends on the authorisation model. Specific authorisation requires approval of the particular subprocessor. General authorisation uses an agreed process for notifying intended changes and allowing objections.

With general authorisation, failure to object within a set period may be interpreted as authorisation. The process must genuinely allow the controller to learn about and assess the change. Where specific authorisation is required, an unanswered approval request does not provide permission to start processing. The EDPB Guidelines 07/2020, paragraphs 153 to 158 explain this distinction.

The founders’ 14-day window is contractual. Celina needs to check its starting point, whether it runs in calendar or working days, how to submit a response and when processing by the new company would start. A reasonable response period takes account of the processing and its complexity. A deadline without enough information to make a decision provides little practical control.

What should the notice tell you?

You need to understand the company, its tasks and the data affected. An updated list of names is useful for maintaining records, but it does not answer all the questions raised by a change.

Request:

• the company’s identity, location and contact details;
• the processing tasks, service and categories of personal data involved;
• processing and access locations, including remote support;
• the intended start date and safeguards appropriate to those operations;
• any transfers outside the EEA and the applicable transfer basis;
• effects on existing instructions, retention and options to disable a feature.

The processor should actively flag intended changes. The Commission’s Article 28 clauses in Decision 2021/915, clause 7.7 provide a general-authorisation option with advance written notice and a period to object. The parties specify the period. These processing clauses do not themselves ensure compliance with GDPR’s international-transfer requirements.

EDPB Opinion 22/2024 explains the need for up-to-date identity information across the processing chain. Verification of safeguards should reflect the risk. A controller does not have to routinely obtain every subprocessing contract, although gaps or concerns may require deeper review. The opinion and guidelines explain GDPR; they are not new legislation.

If the new company wants to use tickets for its own model training, assess purposes, roles, lawful bases and instructions again. Adding a name to a subprocessor list does not resolve that issue. Our AI vendor contract checklist covers those broader procurement questions.

What happens if you object?

GDPR requires an opportunity to object under general authorisation, but does not provide a single operational solution for every service. An objection may require a change to the proposed processing or an end to the relevant arrangement. It does not guarantee that the vendor will redesign its entire product, and it should not be treated as an email that can simply be filed away.

Agree the steps in the DPA. Depending on the product, the parties may arrange feature exclusion, an alternative processing route, additional safeguards or termination of the affected service. Check charges, prepaid fees, export and deletion before relying on an exit mechanism. These commercial consequences need contractual treatment; they do not all follow automatically from Article 28.

Tim discovers that the AI analysis is optional but would, by default, include an enterprise customer’s tickets. Jacob checks whether it can be disabled for that customer. Celina asks about data scope and transfers. If they object, their response should identify the change, the data-protection concern and the resolution sought. They also need confirmation of how tickets will be handled while the issue is addressed.

A request for information does not necessarily pause the contractual deadline. Obtain written agreement if more time is needed. Do not assume that an email asking for details counts as an objection. Follow the DPA’s process and state the position clearly before the deadline.

When your SaaS is itself a processor

Your response to your vendor does not replace authorisation from the controllers that entrusted data to your service. Check your own customer DPAs and instructions before the data flow changes.

The founders need to coordinate three parts of the process:

Suppose the vendor gives the startup 14 days, while the startup has promised its customer 30 days’ advance notice. Those windows need coordination. Arrange enough lead time or another compliant route for that customer’s data. The vendor’s timetable does not amend the startup’s signed customer DPA.

Under GDPR Article 28(4), relevant data-protection obligations must be imposed on the further processor. The initial processor remains fully liable to the controller for that further processor’s performance of its obligations.

Assess transfers separately. Where data is transferred outside the EEA, subprocessor authorisation alone is insufficient: the relevant Chapter V requirements still apply. A claim about an EU hosting region also needs to be checked against actual access and processing arrangements.

Build a response process before the next email

Assign an owner who can coordinate the contract review with the product team. Record:

• receipt date, response deadline and intended change date;
• the parties’ roles and the authorisation model;
• affected data, customers and features;
• missing information and the specific risk identified;
• the decision, its reasons, the response sent and the vendor’s reply;
• configuration tasks and any required customer notifications.

Jacob, Tim and Celina may keep the optional analysis disabled for the selected customer until its terms are clarified. That is one possible decision, dependent on the agreement and technical ability to separate the feature. If compliant continued use is not possible, prepare an exit plan. Data export is a separate workstream covered in our guide to SaaS switching under the Data Act.

Through our technology and SaaS legal services, we can compare the DPA with actual data flows and customer commitments. For a discussion about a subprocessor change, bring the notice, both sets of agreements and the proposed processing start date.