Subprocessor register

Use this to build the register or to check it against contracts and vendors.

Gather from contracts

Collect signed contracts and DPAs, the finance list of paid vendors, and each vendor's own subprocessor page. Note any vendor that touches personal data but has no signed DPA, and any page you could not reach.

Build the register

For each subprocessor record:

• legal name and service provided;
• personal data it receives, and whose;
• processing locations, as the vendor states them;
• contract and DPA, with dates and where they are filed;
• transfer mechanism, if the contract names one;
• the date you last checked, and the source.

Record what the documents say. When a vendor page and the contract disagree, show both and mark it for the owner.

Changes to announce

Compare with the last published list. Give additions, removals, and changes in location or data. If customer contracts require notice before a change, list the notice period and the date it runs out, from the contract text.

Never add a location, DPA, or transfer mechanism the documents do not show. This is not legal advice. Do not publish the page or send notices; the owner approves and sends.