Sub-processor agreements and UK GDPR compliance

Knowledge Hub
for Growth

Article

5 mins read

Updated on 31 January 2025

Our subject expert
Lillian Tsang MBA

Senior Solicitor - Data Protection & Privacy

Sub-processor agreements are a vital part of modern supply chains, but managing them in line with UK GDPR can be a legal and operational challenge.

As businesses increasingly rely on third parties to handle personal data, understanding how to structure, negotiate and oversee these arrangements is essential to remain compliant while keeping your operations running smoothly.

Our data protection solicitors can help you establish practical, compliant agreements, advising on authorisation models, contract terms, risk allocation, and global data transfer issues, so your business can meet its obligations without compromising efficiency.

Appointing and changing sub-processors
Controller-to-processor contracts: Addressing sub-processing terms
Key legal responsibilities when appointing sub-processors
1. For you, as a processor
2. For you, as a controller
Managing sub-processor relationships
Balancing compliance and practical business needs

Appointing and changing sub-processors

Sub-processors are typically third-party suppliers engaged by processors to handle personal data on behalf of controllers (cloud storage providers are a key example).

The UK GDPR sets out important restrictions to stop processors from engaging sub-processors without prior specific or general written authorisation of the controller, i.e.:

With specific authorisation, the controller must approve each sub-processor individually. This means they have maximum control.

On the other hand, general authorisation means controllers will pre-approve a list of sub-processors or criteria for selecting sub-processors. They can receive notifications of changes and make objections to them.

The choice between specific and general authorisation can depend on practical factors, such as bargaining power and the processor's operational practices, so this isn’t a one-size-fits-all approach.

Controllers with more leverage working with smaller suppliers may be able to insist on the specific authorisation route for tighter control over data processing in supply chains. However, larger processors with established supply chains will typically require general authorisation due to operational constraints and the fact that they already operate depending on several third-party processors.

Overall, this can be a heavily negotiated point. For example, the controller wants control, but the processor needs flexibility, as granting absolute discretion to the controller customer would not work with extended supply chains.

When a processor intends to add or replace a sub-processor under general authorisation, the UK GDPR requires them to notify the controller in writing, giving them the right to object by a specific date. Controllers will need sufficient time to assess the proposed change and, if necessary, raise objections. This can also be tricky in negotiations and practice – e.g., how can a processor that is entirely reliant on a sub-processor accommodate objections in practice?

Parties need to find a way forward by considering the practicalities of their projects and reaching a resolution.

The UK GDPR sets out necessary restrictions to stop processors from engaging sub-processors without prior authorisation from the controller (ICO guidance on roles and responsibilities).

Controller-to-processor contracts: Addressing sub-processing terms

Controller-to-processor contracts play a crucial role in determining the terms of sub-processor agreements and ensuring compliance with the UK GDPR.

The contract terms require bespoke drafting to accommodate the practical arrangements for appointing sub-processors (e.g., specifying whether the controller denies using a sub-processor or agrees to provide specific or general authorisation).

Contracts can include key provisions such as:

Prohibiting sub-processors entirely

Requiring pre-approval of a list of sub-processors

Granting prior written authorisation with rights to object within a set timeframe.

Negotiating these terms can become complicated again. Smaller service providers might find that controllers push for more say over who can access their data, especially when it’s sensitive. On the other hand, larger established processors will often come with their own standard terms for sub-processing, on a take-it-or-leave-it basis.

Key legal responsibilities when appointing sub-processors

Appointing sub-processors presents a range of legal challenges that both data controllers and processors must carefully consider to ensure compliance with data protection laws. Here are some key issues to keep in mind:

For you, as a processor

Liability risks: You will be fully liable to the controllers for performing your sub-processor obligations. If a sub-processor fails to comply with legal requirements or mishandles data, you could have a big problem.

Due diligence: You must conduct thorough due diligence when choosing sub-processors to ensure they meet the UK GDPR’s strict data protection standards. This means reviewing their security measures, employee training programmes, and how they’ll secure the data you pass to them. Regular audits and detailed records of your evaluations and appointments are also essential. While this can be challenging if you work with long or complex supply chains, ensuring data is secure at every level is critical.

Sub-processing agreements: You must establish strong agreements with your sub-processors to reflect mandatory data protection requirements and manage risk effectively. This includes flowing down the same or equally robust data protection terms you’ve agreed with your controller to your sub-processors. Controllers often insist on this. However, this can become tricky in practice, especially with global sub-processors, such as large tech companies, which typically enforce their standard terms. You’ll also need to ensure that sub-processors only process data following the controller’s original instructions.

International data transfers: Things get even more complex if your sub-processors are based outside the UK, triggering international data transfer requirements. You’ll need to ensure these arrangements are appropriately structured and comply with the law while keeping clear documentation of your efforts to stay compliant.

For you, as a controller

Oversight and transparency: You will need to understand exactly where your data is going through your due diligence, e.g., to ensure you have proper oversight of sub-processors and verify that they have sufficient guarantees that their data processing will be UK GDPR compliant. You typically rely on your processor’s due diligence findings to understand this. You may also want to review sub-processing agreements to verify compliance, so your processors should have this covered.

Managing sub-processor relationships under UK GDPR can be complex, especially when working with long or international supply chains. Balancing strict legal requirements with business realities often calls for expert legal advice. This is essential for drafting and negotiating agreements that ensure compliance and work for your operations.

Managing sub-processor relationships

Managing sub-processors effectively needs proactive planning, open communication and sometimes creative solutions.

In the modern business market, processors are increasingly seeking a controller’s general authorisation to appoint sub-processors, while also providing visibility (e.g., by giving their customers a list of sub-processors to sign off on). In this case, it’s crucial to have a smooth and efficient procedure for notifying and handling objections to changes.

Parties need to understand how to structure sub-processor agreements that meet legal obligations while reflecting the practical realities of doing business. This often requires collaboration and compromise, and legal advice can help parties understand the risks, reach a solution, and structure their agreements to align with both legal requirements and operational realities, enabling them to conduct business effectively.

Balancing compliance and practical business needs

Getting sub-processor relationships right means navigating strict UK GDPR obligations while also responding to and balancing commercial demands. It requires careful drafting, proactive risk management and, often, compromise between controllers and processors.

Our data protection solicitors can help you manage these legal complexities, whether you’re appointing new sub-processors, handling objections, or reviewing due diligence and contractual flow-downs. We’ll support you in creating agreements that protect your business and keep it moving.

About our expert

Lillian Tsang MBA

Senior Solicitor - Data Protection & Privacy

Lillian is an experienced data protection, privacy and AI lawyer, who qualified in England and Wales in 2008. She helps businesses navigate complex and fast-changing data laws with confidence, combining technical expertise with practical, commercially focused advice.

View Profile 