Replacing a subprocessor: prior notice and response period in the data processing agreement

When a processor replaces a subprocessor, the controller must receive a genuine opportunity to assess the change in advance. Article 28(2) GDPR requires information about planned changes and an appropriate opportunity to object. The contract therefore needs a workable notice route, a response period and a process for a reasoned objection.

This article follows the change from both roles. It focuses on information about the new provider, checks of access and safeguards, and the flow-down of data protection duties under Article 28(4) GDPR. Initial role qualification, international transfers as the main issue and data breaches are outside this article.

First establish whether a new subprocessor is being added or an existing one is being replaced. A new company, data centre, support organisation or subcontracting chain can change access and data flows. The controller therefore needs concrete information about service, location, data and planned start.

Article 28(2) GDPR addresses planned changes involving other processors. A general provider list does not replace contractually required communication when the controller cannot identify the change or its response opportunity.

The article on SaaS roles covers the prior role assessment. This article concerns the later change within an existing processing arrangement.

The notice should identify the new subprocessor and describe the service. It should also cover relevant location, systems, data categories, access type and planned timing. If several processing steps are affected, the notice should separate them.

The controller must be able to see what changes compared with the current arrangement. A change description, safeguards and a contact person may be needed together. The documents must support an actual review rather than a general assurance.

Keep evidence of delivery and receipt. The processor should record when the response period starts and through which channel an objection must be submitted. This reduces disputes about timing and notice content.

The controller compares the planned provider with the current one. Review actual access, locations, remote administration, transfers, safeguards, deletion and instruction binding. The review must reflect the processing activity and cannot always stop at a certificate.

An objection should connect to data protection facts, such as an unclear location, weak access control, missing deletion checks or a departure from instructions. The controller records evidence and requested remediation. The processor assesses the objection against the contract and actual risk.

The response period must allow a meaningful review. An impractically short period can undermine the agreed control. The contract should therefore specify start, channel, content and treatment of questions.

Article 28(4) GDPR requires the processor to impose the same data protection duties on the other processor as those agreed with the controller. Depending on the duty, this covers documented instructions, confidentiality, security, assistance and return or deletion at the end of the service.

The chain must be checked rather than assumed. The processor reviews whether the sub-contract contains the required duties and whether the provider can perform them. The controller records the evidence received and open points before the change.

If the provider changes the data flow, records, security documentation and any impact assessment may also require review. The Article 30 records article adds the documentation perspective.

A reasoned objection needs a traceable response. Depending on the contract and facts, the processor may assess an alternative, improve safeguards or pause implementation. The workable solution depends on service, risk and the agreed structure.

If no acceptable alternative exists, the parties should not continue through a silent replacement. The contract should address interim services, protection or return of data and an organised transition or termination. No automatic legal consequence should be inferred from silence in the contract.

Keep the decision, communications, periods and implementation evidence. A breach after the change involves separate duties. The article on processor data breaches remains a separate topic.

The list is changed only afterwards: A later publication removes the prior review opportunity.

The provider name is treated as sufficient: Without service, access, location and timing, the change is unclear.

The period is unusable: An overly short period prevents meaningful review of safeguards and data flow.

The objection has no outcome: Contract, contact and alternatives must address a reasoned objection.

The sub-contract is not checked: Article 28(4) requires the same data protection duties to be imposed on the other processor.

Create a change file with current and new provider, service, data categories, locations, access and start date. Add the prior notice, delivery evidence, contractual period and contact person. Then review safeguards, sub-contract, deletion, instructions and alternatives.

The decision records the assessment and the reasons for any objection. After implementation, check systems, permissions, locations and documents against the agreed state. Reassess material changes to service, access or risk. The processor checklist supports the structured review.

We review notice, data flow, sub-contract, safeguards, response period and the treatment of a reasoned objection together. For an initial assessment, use the current processing agreement, provider list, new provider description, data categories and technical access details. This shows whether notice, review and implementation are aligned.