Subprocessor lists
The list your client's customers ask for, built from the vendors that client actually uses, with the entity and transfer mechanism of each one taken from a registry we check ourselves.
Free · No sign-up · Up to ten websites
A subprocessor list names the other companies a processor uses to deliver its service. Article 28 of the GDPR lets a processor engage another processor only with the controller's authorisation, and the controller has to be told about changes in time to object — which is why the list is usually published alongside the data processing agreement.
The awkward part is that it goes stale quietly. A vendor moves its EU contracting entity, replaces a transfer mechanism or adds a sub-processor of its own, and every list that named it is wrong until somebody notices.
What it has to cover
From a registry
Each vendor is one record: entity, country, transfer mechanism, DPA link and the date it was verified. Every client's list reads the same record, so two clients can never disagree about the same vendor.
Matched, not typed
The names a client gives in the interview, or that appear in their existing documents, are matched to registry records instead of being retyped per client.
Changes tracked
Vendor pages are checked daily. A change is reviewed by a person before it reaches you, and then shows which of your clients it affects and which documents to regenerate.
Every vendor fact comes from our own registry: 157 vendors with the date each entry was checked.
Vendors with their legal entity, country, transfer mechanism, DPA and sub-processor links, each with the date it was last checked.
The list is assembled from the client's vendors and the registry, so it never contains a vendor or a URL that is not in the data.
Publish the list on the client's trust page, under your brand, and keep the document version for their DPA.
When a vendor's entity or terms change, the documents naming it are marked out of date per client.
Read the client's current list from a DOCX or PDF, keeping only facts that appear in the document, each with its quote.
Take the whole registry as a CSV when you want to work outside the workspace.
From the interview, from a document you import, or from a scan of their website. Each name resolves to one registry record.
The table is built from those records with your firm's wording around it, and the same facts feed the record of processing.
Publish on the client's trust page or export it, then get told when a vendor changes so you can regenerate before anyone asks.
Other tasks
Enter up to ten client websites. Free, no sign-up, the first report in about a minute.
