Harper James advises UK businesses on commercial contracts and data protection obligations under the laws of England and Wales, including arrangements involving sub-processors. Under the UK GDPR, a sub-processor is a separate organisation appointed by a processor to process personal data on behalf of a controller.
A controller must authorise the processor’s use of sub-processors under the Article 28 data processing agreement. The authorisation can be specific, requiring approval for each appointment, or general, allowing the processor to appoint sub-processors subject to advance notice and an opportunity for the controller to object. The agreement should state the notice period, the information supplied about a proposed sub-processor, the objection process and the consequences if the parties cannot resolve an objection.
The processor must impose data protection obligations on the sub-processor through a written contract. Those obligations must provide an equivalent level of protection to the controller-processor agreement, including requirements for confidentiality, security measures, assistance with data subject rights, breach notifications, audits and deletion or return of personal data. The original processor remains responsible to the controller for the sub-processor’s performance.
Before approving a sub-processor, the controller should assess the organisation’s services, security controls, location, ownership, relevant certifications, incident history and use of further sub-processors. The contract should identify the processing activities, categories of personal data, data subjects, processing locations and retention arrangements. A maintained sub-processor register should record approvals, contract dates, service changes, review dates and any objections.
Oversight continues after appointment. Controllers should require prompt notification of material changes, appropriate audit or assurance rights, evidence of security testing and a clear process for investigating incidents. The agreement should also require the processor to notify the controller when a sub-processor suffers a personal data breach or fails to meet its contractual obligations.
If a sub-processor accesses or stores personal data outside the United Kingdom, the arrangement must satisfy the UK GDPR rules on restricted transfers. The parties should identify the transfer mechanism, assess the destination country where required, and document supplementary safeguards. The contract should also address deletion or return of data when services end, assistance with transition to a replacement provider, and the secure removal of copies from systems and backups where practicable.
A practical management process therefore combines a clear Article 28 agreement, documented approval, supplier due diligence, a current sub-processor register and periodic review. The controller should ensure that procurement, information security and legal teams receive notice of changes, because a new sub-processor can affect data flows, international transfer compliance and the organisation’s wider risk assessment.