Harper James advises start-ups, scale-ups and established businesses on structuring data processing arrangements under the laws of England and Wales. A well-drafted sub-processor contract gives a controller visibility and control over suppliers that process personal data through a processor.
Article 28 of the UK GDPR requires a processor to obtain the controller’s prior specific or general written authorisation before appointing a sub-processor. If general authorisation is used, the processor must inform the controller of proposed additions or replacements and give the controller a reasonable opportunity to object. The sub-processor must accept data protection obligations equivalent to those in the main processing agreement, including confidentiality, security, assistance with data subject rights, breach notifications, audits and deletion or return of data.
The controller remains responsible for selecting an appropriate processor and setting clear instructions. Businesses reviewing SaaS, hosting, payroll, marketing and customer support arrangements should maintain a current sub-processor register, record each approval, and check where data is stored and accessed. The latest practical guidance on UK GDPR processing contracts provides a useful starting point for reviewing these arrangements.
A sub-processor schedule should identify the supplier, service, processing location, categories of personal data and categories of data subjects. It should also state how changes are notified, the objection period, and what happens if the controller objects. Security requirements need practical detail, such as access controls, encryption, resilience, vulnerability management, staff training and incident escalation times. A processor should not promise rights that it cannot obtain from its own suppliers, so flow-down obligations need to match the technology and operating model.
International transfers require separate analysis. Where a sub-processor receives or accesses UK personal data from outside the UK, the parties should assess UK transfer regulations, adequacy regulations and appropriate safeguards, including the UK International Data Transfer Agreement or the UK Addendum where applicable. A transfer mechanism does not replace the need for a compliant processing contract or a documented transfer risk assessment.
Start by mapping every supplier that handles personal data, including suppliers appointed by an existing processor. Then compare the main data processing agreement with each sub-processor contract, focusing on audit rights, breach management, deletion, liability and onward transfers. Finally, align the contract with the supplier’s actual service, document approvals and set a review trigger for new processing activities, material technology changes or regulatory updates. This approach gives commercial teams a manageable governance process without treating a static supplier list as sufficient protection.