What is a subprocessor?
A subprocessor is a third party that a vendor engages to process personal data on behalf of that vendor's customer. If your company (the controller) uses a support platform (the processor), and that platform stores data with a cloud provider or sends text to a language model provider, those providers are subprocessors.
The idea comes from data protection law. GDPR Article 28 does not use the word subprocessor, but it governs "another processor" engaged by a processor, and the term has become standard in contracts, trust centers and security reviews.
Controller, processor and subprocessor
Controller. Decides why and how personal data is processed. In support, that is the company whose customers are writing in.
Processor. Processes the data on the controller's instructions, under a data processing agreement. The AI support vendor.
Subprocessor. Processes the data on the processor's behalf: hosting, databases, language model inference, error monitoring, analytics.
GDPR rules for subprocessors
Article 28(2) says a processor may not engage another processor without the controller's prior specific or general written authorisation. With general authorisation, which is what most SaaS DPAs use, the processor must inform the controller of any intended addition or replacement and give it the opportunity to object.
Article 28(4) says the processor must impose the same data protection obligations on the subprocessor by contract, in particular sufficient guarantees on security. If the subprocessor fails, the original processor remains fully liable to the controller. In practice, that is why a trustworthy vendor keeps its subprocessor list short, current and public.
What a subprocessor list should show
The legal name of each subprocessor.
The purpose, for example hosting, database, language model inference or error monitoring.
The location or region where it processes data.
What category of data it receives, where that is limited.
How you are notified of changes, and how to object.
Subprocessors in AI customer support
AI support adds a category of subprocessor most older SaaS products did not have: the language model provider. Every prompt the agent sends can contain a customer's name, order details or account information. Buyers should check three things. First, that each model provider is listed. Second, that the vendor's agreement with that provider prohibits training on your data. Third, which region the model endpoints run in, because data residency for storage means less if inference happens elsewhere.
How Fini publishes its subprocessors
Fini lists its current subprocessors, with purpose and location, on its subprocessors page, and references them in its Data Processing Addendum. That page is the Subprocessor List the DPA refers to, and it shows the date of its last update. Fini gives at least thirty days' notice before a new subprocessor processes customer data, and customers can object on reasonable grounds within fifteen days by writing to legal@usefini.com. Language model providers process customer data under enterprise agreements that exclude training on it.
Review Fini's subprocessors and hosting region with the team. Book a call.
Frequently asked questions
What is a subprocessor under GDPR?
A subprocessor is another processor that a processor engages to carry out specific processing on behalf of the controller. GDPR Article 28 does not use the word, but Articles 28(2) and 28(4) set the rules: prior written authorisation from the controller, notice of changes with a chance to object, and the same data protection obligations passed down by contract.
Is a language model provider a subprocessor?
Usually, yes. If an AI support vendor sends conversation data containing personal data to a model provider to generate replies, that provider is processing personal data on the vendor's behalf and should appear on the vendor's subprocessor list and in its DPA.
What is the difference between a processor and a subprocessor?
A processor handles personal data on behalf of the controller, the company that decides why the data is used. A subprocessor handles it on behalf of the processor. The controller contracts with the processor; the processor contracts with the subprocessor and stays fully liable to the controller for the subprocessor's performance.
How much notice should a vendor give before adding a subprocessor?
GDPR requires the processor to inform the controller of intended changes and give it the opportunity to object, but it does not fix a number of days. Thirty days is a common commitment in vendor DPAs. Check the notice period and the objection process in your DPA.
Is AWS a subprocessor?
A cloud provider such as AWS, Google Cloud or Microsoft Azure is a subprocessor when it hosts or processes personal data on the processor's behalf. It should appear on the processor's subprocessor list with its purpose and region.
Where can I find a vendor's subprocessor list?
Most vendors publish it on a dedicated page that their DPA names as the current list, and many mirror it in a trust center. Check the date of the last update and how the vendor tells you about changes.