What is a subprocessor list and how do you read one?

A subprocessor list names the outside companies your provider hands your data to while it delivers the service: the cloud underneath, the email sender, the payment processor, the support desk. Reading it tells you where your data really travels, which a region picker can't. Look at four things per row: the legal entity, the country, the data it receives and the transfer safeguard.

This guide isn't legal advice.

The terms at a glance

Why the list exists

Article 28 of the GDPR says a processor can't engage another processor without your prior specific or general written authorisation. Most hosting contracts use the general kind: you approve the list as it stands, and the provider must tell you about any intended addition or replacement so you get a chance to object.

The same article says the processor must pass its data protection obligations down to each subprocessor by contract, and it stays fully liable to you if a subprocessor fails to meet them. So the list isn't a courtesy page. It's the published half of a legal duty, and the DPA is the other half.

What to check on each row

• The exact legal entity. "Stripe" tells you little. "Stripe Payments Europe, Ltd." in Ireland tells you which company holds the data and where it's registered.
• The country, and the parent group. A European address can belong to a group based elsewhere. Some lists say so in a transfer column; others leave you to look it up.
• The data it receives. A CDN may see IP addresses and request headers. A database host sees everything in your database. Weigh each row by what flows to it, not by its name.
• Whether it applies to you. Many rows only switch on when you use a feature, such as connecting a code host or paying by card.
• The transfer safeguard. For any row outside the EEA, the list or the DPA should name the mechanism: an adequacy decision, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses.
• How changes reach you. Look for the notice method and the objection window. Without them, the list can change under you.

The columns, one by one

Most lists are a table, and the column names vary. Here is how to read the common ones.

Provider and entity. Note the legal form, such as SAS, Ltd., Inc. or e.V. It tells you the company type and usually the country of registration.

Purpose. This should be specific, like "email delivery" or "hosting". A vague purpose such as "business operations" makes it hard to judge the risk.

Data categories. Look for a list of what is shared. "Customer content" means the row can touch the data inside your app, not just account details.

Location. Read it together with the entity. "Global" or "USA or Europe depending on the request" means the data can be processed outside the EEA.

Transfer mechanism. The European Commission published modernised Standard Contractual Clauses on 4 June 2021, replacing the older sets. A list that still cites clauses from before that date is worth a question.

Two real lists, read side by side

Here is how the method works on two hosting providers that publish their lists.

Provider	Hosting subprocessor	Rows outside the EU	Safeguard named	Change notice
Scalingo	Outscale, for database hosting, with data in France	None for your app data; Intercom and PayPal list USA and Cloudflare lists USA or Europe for account data	SCCs from June 2021 or the EU-U.S. Data Privacy Framework, row by row	8 calendar days to contest a change, on four listed grounds
Eurobase	Scaleway SAS, a French provider, for hosting, runtime, database, storage and email delivery	GitHub, Inc. and GitLab Inc. list United States / global, only once you connect them	Each provider's contractual transfer safeguards	Advance notice, then 30 days to object

Scalingo. Its data processing agreement holds two separate lists, and telling them apart is the main lesson. The first covers the data you host, where Scalingo acts as your processor: it has one row, Outscale for database hosting, with no transfer outside the EU. The second covers data about you and your team, such as billing and support contacts, where Scalingo is the controller: that's where Brevo, Cloudflare, Intercom, PayPal, Pipedrive and Stripe appear, each with location and transfer columns. Cloudflare's row is marked for custom contracts or specific customer requests, so it may not apply to a standard account. The agreement also says some of these subprocessors belong to groups outside the EEA, which is the parent-group question from the checklist above.

Eurobase. The subprocessor page has five rows in one list. Scaleway carries the infrastructure. GitHub, Inc. and GitLab Inc. sit in the United States and only start receiving data when you connect them. Codeberg e.V., a German association, is the European way to link a repository. Stripe Payments Europe, Ltd. runs checkout, subscriptions and invoices. A separate section admits that copies held by these providers, such as backups or Stripe records, aren't erased just because you delete something in Eurobase, and that no single expiry date covers them. A list that is open about leftover copies like this is easier to trust than one that stays silent.

Warning signs

1. No list at all, or a list you can only get after signing.
2. Company names without legal entities or countries.
3. No data categories, so every row looks the same.
4. Rows outside the EEA with no named safeguard.
5. No notice process, or a clause that lets the provider change subprocessors with no way for you to object.
6. A "last updated" date that is years old on a service that has clearly added features since.

What to do with what you find

1. Keep a copy of the list you approved, with the date.
2. Mark every row that receives your users' personal data, and every row outside the EEA.
3. Turn off optional features whose subprocessors you don't need.
4. Copy the relevant rows into your own records of processing and privacy notice, since your users' data now passes through them.
5. Subscribe to change notices, and put the objection deadline in your calendar when one arrives.

For the contract around the list, see the DPA checklist and Standard Contractual Clauses. For the jurisdiction side, read EU region vs EU company and data residency vs data sovereignty.

Frequently asked questions

What is the difference between a processor and a subprocessor?

A processor handles personal data on your behalf, such as your hosting platform. A subprocessor is a company that processor brings in for part of the job, such as the cloud it runs on. Both have to follow the same data protection obligations, and the processor answers to you for the subprocessor.

Do I need to tell my users about my provider's subprocessors?

Your privacy notice has to describe the recipients of your users' personal data, and recipients can be named or described by category. Many companies link to their providers' lists, or name the main ones directly. Check with your own adviser what your notice needs.

Can I object to a new subprocessor?

Yes, when your DPA uses general written authorisation. Article 28 requires the processor to inform you of intended changes so you have the chance to object. The DPA sets how long you have and what happens next, which may be a fix, an alternative or the right to end the affected service.

Does a US company on the list make the provider non-compliant?

Not by itself. The GDPR allows transfers outside the EEA through an adequacy decision, which for the United States covers only companies taking part in the EU-U.S. Data Privacy Framework, or through Standard Contractual Clauses. Whether that is enough for your contract or sector is a separate question.

Where do I find a provider's subprocessor list?

Look in the footer under legal, trust or privacy pages, or inside the DPA itself. Some providers keep it behind a trust portal where you request access. If you can't find it, ask support for it before you sign.

Sources

• GDPR Article 28: Processor
• GDPR Article 4: Definitions
• GDPR Article 13: Information to be provided
• European Commission: Standard Contractual Clauses
• European Commission: Adequacy decisions
• Scalingo data processing agreement
• Eurobase subprocessors and Eurobase DPA