Knowledge Hub
for Growth


​​​Managing sub-processor agreements under UK GDPR

Sub-processor agreements are a vital part of modern supply chains, but managing them in line with UK GDPR can be a legal and operational challenge.

As businesses increasingly rely on third parties to handle personal data, understanding how to structure, negotiate and oversee these arrangements is essential to remain compliant while keeping your operations running smoothly.

Our data protection solicitors can help you establish practical, compliant agreements, advising on authorisation models, contract terms, risk allocation, and global data transfer issues, so your business can meet its obligations without compromising efficiency.

Appointing and changing sub-processors 

Sub-processors are typically third-party suppliers engaged by processors to handle personal data on behalf of controllers (cloud storage providers are a key example).  

The UK GDPR sets out important restrictions to stop processors from engaging sub-processors without prior specific or general written authorisation of the controller, i.e.: 

  • With specific authorisation, the controller must approve each sub-processor individually. This means they have maximum control.  
  • On the other hand, general authorisation means controllers will pre-approve a list of sub-processors or criteria for selecting sub-processors. They can receive notifications of changes and make objections to them.   

The choice between specific and general authorisation can depend on practical factors, such as bargaining power and the processor's operational practices, so this isn’t a one-size-fits-all approach.  

Controllers with more leverage working with smaller suppliers may be able to insist on the specific authorisation route for tighter control over data processing in supply chains. However, larger processors with established supply chains will typically require general authorisation due to operational constraints and the fact that they already operate depending on several third-party processors.  

Overall, this can be a heavily negotiated point. For example, the controller wants control, but the processor needs flexibility, as granting absolute discretion to the controller customer would not work with extended supply chains.  

​​​When a processor intends to add or replace a sub-processor under general authorisation, the UK GDPR requires them to notify the controller in writing, giving them the right to object by a specific date. Controllers will need sufficient time to assess the proposed change and, if necessary, raise objections. This can also be tricky in negotiations and practice – e.g., how can a processor that is entirely reliant on a sub-processor accommodate objections in practice?  

Parties need to find a way forward by considering the practicalities of their projects and reaching a resolution.  

The UK GDPR sets out necessary restrictions to stop processors from engaging sub-processors without prior authorisation from the controller (ICO guidance on roles and responsibilities).

Controller-to-processor contracts: Addressing sub-processing terms 

Controller-to-processor contracts play a crucial role in determining the terms of sub-processor agreements and ensuring compliance with the UK GDPR. 

The contract terms require bespoke drafting to accommodate the practical arrangements for appointing sub-processors (e.g., specifying whether the controller denies using a sub-processor or agrees to provide specific or general authorisation).  

Contracts can include key provisions such as: 

  • Prohibiting sub-processors entirely 
  • Requiring pre-approval of a list of sub-processors 
  • Granting prior written authorisation with rights to object within a set timeframe.   

Negotiating these terms can become complicated again. Smaller service providers might find that controllers push for more say over who can access their data, especially when it’s sensitive. On the other hand, larger established processors will often come with their own standard terms for sub-processing, on a take-it-or-leave-it basis.  

Key legal responsibilities when appointing sub-processors 

Appointing sub-processors presents a range of legal challenges that both data controllers and processors must carefully consider to ensure compliance with data protection laws. Here are some key issues to keep in mind: 

For you, as a processor 

  • Liability risks: You will be fully liable to the controllers for performing your sub-processor obligations. If a sub-processor fails to comply with legal requirements or mishandles data, you could have a big problem. 
  • Due diligence: You must conduct thorough due diligence when choosing sub-processors to ensure they meet the UK GDPR’s strict data protection standards. This means reviewing their security measures, employee training programmes, and how they’ll secure the data you pass to them. Regular audits and detailed records of your evaluations and appointments are also essential. While this can be challenging if you work with long or complex supply chains, ensuring data is secure at every level is critical. 
  • Sub-processing agreements: You must establish strong agreements with your sub-processors to reflect mandatory data protection requirements and manage risk effectively. This includes flowing down the same or equally robust data protection terms you’ve agreed with your controller to your sub-processors. Controllers often insist on this. However, this can become tricky in practice, especially with global sub-processors, such as large tech companies, which typically enforce their standard terms. You’ll also need to ensure that sub-processors only process data following the controller’s original instructions. 
  • International data transfers: Things get even more complex if your sub-processors are based outside the UK, triggering international data transfer requirements. You’ll need to ensure these arrangements are appropriately structured and comply with the law while keeping clear documentation of your efforts to stay compliant. 

For you, as a controller 

  • Oversight and transparency: You will need to understand exactly where your data is going through your due diligence, e.g., to ensure you have proper oversight of sub-processors and verify that they have sufficient guarantees that their data processing will be UK GDPR compliant. You typically rely on your processor’s due diligence findings to understand this. You may also want to review sub-processing agreements to verify compliance, so your processors should have this covered.  

Managing sub-processor relationships under UK GDPR can be complex, especially when working with long or international supply chains. Balancing strict legal requirements with business realities often calls for expert legal advice. This is essential for drafting and negotiating agreements that ensure compliance and work for your operations. 

Managing sub-processor relationships 

Managing sub-processors effectively needs proactive planning, open communication and sometimes creative solutions.   

In the modern business market, processors are increasingly seeking a controller’s general authorisation to appoint sub-processors, while also providing visibility (e.g., by giving their customers a list of sub-processors to sign off on). In this case, it’s crucial to have a smooth and efficient procedure for notifying and handling objections to changes.  

Parties need to understand how to structure sub-processor agreements that meet legal obligations while reflecting the practical realities of doing business. This often requires collaboration and compromise, and legal advice can help parties understand the risks, reach a solution, and structure their agreements to align with both legal requirements and operational realities, enabling them to conduct business effectively.   

Balancing compliance and practical business needs 

Getting sub-processor relationships right means navigating strict UK GDPR obligations while also responding to and balancing commercial demands. It requires careful drafting, proactive risk management and, often, compromise between controllers and processors.

Our data protection solicitors can help you manage these legal complexities, whether you’re appointing new sub-processors, handling objections, or reviewing due diligence and contractual flow-downs. We’ll support you in creating agreements that protect your business and keep it moving.

About our expert

Lillian Tsang MBA

Lillian Tsang MBA

Senior Data Protection and Privacy Solicitor
Lillian is an experienced data protection and privacy lawyer who qualified in 2008. She advises clients on a broad range of matters - from strategic compliance with a global stance to day-to-day operations. Her role also includes Harper James' Head of DPOaaS division (Data Protection Officer as a Service), where we act as the external DPO for a business or provide support to existing DPOs.


What next?

Please leave us your details and we’ll contact you to discuss your situation and legal requirements. There’s no charge for your initial consultation, and no-obligation to instruct us. We aim to respond to all messages received within 24 hours.

Your data will only be used by Harper James. We will never sell your data and promise to keep it secure. You can find further information in our Privacy Policy.


Our offices

A national law firm

A national law firm

Our commercial lawyers are based in or close to major cities across the UK, providing expert legal advice to clients both locally and nationally.

We mainly work remotely, so we can work with you wherever you are. But we can arrange face-to-face meeting at our offices or a location of your choosing.

Head Office

Floor 5, Cavendish House, 39-41 Waterloo Street, Birmingham, B2 5PP
Regional Spaces

Capital Tower Business Centre, 3rd Floor, Capital Tower, Greyfriars Road, Cardiff, CF10 3AG
Stirling House, Cambridge Innovation Park, Denny End Road, Waterbeach, Cambridge, CB25 9QE
13th Floor, Piccadilly Plaza, Manchester, M1 4BT
10 Fitzroy Square, London, W1T 5HP
Belsyre Court, 57 Woodstock Road, Oxford, OX2 6HJ
1st Floor, Dearing House, 1 Young St, Sheffield, S1 4UP
White Building Studios, 1-4 Cumberland Place, Southampton, SO15 2NP
A national law firm

Like what you’re reading?

Get new articles delivered to your inbox

Join 8,153 entrepreneurs reading our latest news, guides and insights.

Subscribe


To access legal support from just £149 per hour arrange your no-obligation initial consultation to discuss your business requirements.

Make an enquiry