Subprocessor list template
A subprocessor list tells your customers which vendors process their personal data on your behalf, for what, and where.
Why customers ask for it
Under Art. 28(2) GDPR, a processor may only engage another processor with the controller's written authorisation. Where the authorisation is general, the processor must inform the controller of intended additions or replacements and give it the chance to object. A published list, plus a way to hear about changes, is a common way to do that.
Columns
- Vendor: the company name.
- Purpose: what the vendor does for your product, in plain words.
- Categories of personal data: what you send it (for example account data, email addresses, usage logs).
- Data location: where the data is stored or processed.
- Transfer mechanism: what the vendor relies on for transfers outside the EEA, such as SCCs or the EU-U.S. Data Privacy Framework.
- Vendor DPA: a link to the vendor's data processing agreement.
- Date added: so customers can see when the list changed.
The vendor columns are the tedious part. The vendor pages collect them with sources.
Example
The rows below are fictional and only show the format.
| Vendor | Purpose | Categories of personal data | Data location | Transfer mechanism | Vendor DPA | Date added |
|---|---|---|---|---|---|---|
| Example Hosting Ltd (fictional) | Application hosting | Account data, usage logs | EU (Frankfurt) | Not needed (EU only) | https://example.com/dpa | 2026-01-15 |
| Example Mail Inc (fictional) | Transactional email | Email addresses, names | US | SCCs | https://example.com/mail-dpa | 2026-03-02 |
Download
Rather start from your stack? Pick your vendors in the generator and the vendor columns are filled in for you.
Templates, not legal advice. Have your own counsel check anything you send to a customer.