PrivacyGDPR

Keep your sub-processor register

Record each vendor that processes personal data for you, file its DPA, track renewals and choose which vendors your Privacy Center lists.

Updated 2 min read

The Sub-processors tab of Compliance › Privacy is your Article 28 register: the vendors that process personal data on your behalf, and the DPA that covers each. Under GDPR Article 28(3), processing by a processor is governed by a contract that sets out the processing and the processor's obligations. The same tab holds your customer DPAs below the vendors.

Add a sub-processor

Select Add sub-processor. Add a sub-processor asks for:

  • Vendor: the Legal name as it appears on the signed DPA, Trading name, Website, an icon, Vendor jurisdiction and Public DPA / terms URL.
  • Purpose: the Service category and What they do.
  • Data transfer & safeguards: Where data is processed, the Transfer mechanism (required when processing happens outside the EU/EEA) and any Supplementary measures.
  • Contract: Reference number, Signed on, Term and Auto-renewal. The renewal date follows from the signing date and the term.
  • Signed DPA document: the PDF, which you can also upload later.
  • Public disclosure: whether to Show on the public sub-processor list.

Keep each agreement current

The tiles count Active DPAs, those Publicly listed, those Due for renewal (within 60 days, overdue included) and your Customer DPAs. Open a vendor to:

  • Renew now: start a new term today. The signing date moves to today and the renewal date follows from the term. Nothing is sent to the vendor, and an agreement with no fixed term can't be renewed.
  • Mark superseded: record that the agreement is no longer in force. The record stays, read-only, and stops counting as an active DPA.
  • Upload or Replace the signed DPA under Contract. It's listed in your Documents too.
  • Edit details, from the drawer's menu.

Linked RoPA activities shows the processing activities that name the vendor as a recipient. See Build your record of processing activities.

Your public sub-processor list

Vendors marked Show on the public sub-processor list and still in force appear in a Sub-processors section on your Privacy Center's home page, with each vendor's name, website, service category, country and processing location. The list shows only while the Privacy register is open, and a superseded vendor drops off it. See Privacy Center basics.