Sub-processor List Template (GDPR Art. 28)

Public sub-processor list: entity, service, data, location, transfer tool, affiliates, change notice and objection process, change log

LegalBreveGDPR Art. 28(2), 28(4)subprocessor listActualizada 29 oct 2026

Abrir en el editorDescargar .md

Cómo usar: Use it when you process customer personal data as a processor and rely on general written authorisation for sub-processors. Fill the table from signed contracts and match the notice period to your DPA. The main pitfall is listing only hosting and forgetting support tools and affiliates with data access.

Vista previa

Sub-processor List: [Provider name]

Format for the public list of sub-processors that a processor (for example a SaaS provider) engages to process customers' personal data, with the change notice and objection process. Based on GDPR Art. 28(2) and 28(4) (Regulation (EU) 2016/679; the UK GDPR has the same article numbers). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice. Check the current text and your data processing agreements before publishing.

Field	Value
Document ID	[PRIV-SUB-001]
Provider (processor)	[Legal name]
Owner	[@owner, Privacy]
Last updated	YYYY-MM-DD
Notice period for changes	[30] days before the new sub-processor starts processing
Subscribe for change notices	[Link to subscription form or RSS feed]

Current sub-processors

ID	Sub-processor (legal entity)	Service provided	Personal data processed	Location of processing	Transfer tool	Since
SUB-001	[Hosting provider]	[Cloud hosting and storage]	[All customer data]	[EU region (country)]	[None needed]	YYYY-MM-DD
SUB-002	[Email delivery provider]	[Transactional email]	[Names, email addresses]	[Country]	[SCCs (EU) 2021/914 / adequacy decision]	YYYY-MM-DD
SUB-003	[Support tool provider]	[Customer support tickets]	[Contact details, ticket content]	[Country]	[Tool]	YYYY-MM-DD
SUB-004 (Example)	Ferncliff Hosting GmbH (fictional)	Hosting for Tarnwick Forms	All form content and account data	Germany	None needed	2026-01-05

Affiliates

ID	Affiliate	Role	Location	Transfer tool
SUB-AFF-001	[Group company]	[Follow-the-sun support]	[Country]	[Intra-group SCCs]

Changes and objections

We announce an intended new or replacement sub-processor on this page and by [email to subscribed contacts] at least [30] days before it starts processing personal data.
A customer may object on reasonable data protection grounds by writing to [privacy@example.com] within [the notice period].
We will discuss the objection in good faith and, where possible, offer an alternative. If we cannot, the customer may [terminate the affected service and receive a refund of prepaid fees for the unused period], as set out in the DPA.
In an emergency (for example to keep the service secure or available) we may replace a sub-processor at shorter notice and will explain why.

Change log

Date announced	Change	Sub-processor	Effective date
YYYY-MM-DD	[Added / Removed / Location changed]	[Name]	YYYY-MM-DD
2026-11-02 (Example)	Added: transactional email for form receipts	Wrenmoor Mail Ltd (fictional), Ireland	2026-12-02

Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR), Art. 28(2) and 28(4), paraphrased in original words; the UK GDPR uses the same article numbers. Related templates: legal-lite/dpa, compliance/transfer-impact-assessment, legal-lite/privacy-policy. This is a documentation format, not legal advice. Original text written for this collection; examples are fictional. Template licence: MIT.

Plantillas relacionadas

Legal