# Sub-processor > any Processor engaged by the Provider. **Term:** Sub-processor **Last updated:** 2026-07-29 ## Definition ## What Sub-processor Means in a Contract In a data processing agreement, a Sub-processor is any entity that a Provider (itself acting as a Processor of personal data) brings in to help carry out processing activities on behalf of a Controller. The term exists because modern service delivery rarely happens through a single company. A Provider might use cloud infrastructure vendors, analytics tools, customer support platforms, or specialist contractors, and each of these, if they touch personal data, becomes a Sub-processor under the chain of accountability the contract establishes. The concept matters because data protection law generally requires that any processing of personal data be governed by a written contract, and that chain of contracts must extend all the way down to whoever actually handles the data. A Sub-processor clause makes explicit that the Provider is not processing data alone, and it sets out how the Provider must manage, disclose, and remain responsible for those additional parties. ## How Sub-processor Is Defined or Measured Most agreements define a Sub-processor by function rather than by name: any third party engaged by the Provider to process personal data in connection with performance of the services. This functional test means a company does not need to be labeled a Sub-processor to be treated as one; if it processes personal data on the Provider's instructions, the definition applies regardless of the commercial label attached to the relationship. Contracts typically measure and control Sub-processor status through a few mechanisms. A current list of approved Sub-processors is often maintained, sometimes as a schedule to the agreement and sometimes on a public webpage the customer can monitor. Obligations flow down contractually, meaning the Provider must impose data protection terms on each Sub-processor that are at least as protective as those in the head agreement. Liability for a Sub-processor's failures usually remains with the Provider, who cannot use subcontracting as a shield against its own obligations. - Functional definition based on data processing activity, not job title - Disclosure through a list, schedule, or notification process - Flow-down obligations mirroring the Provider's own duties - Provider retains liability for Sub-processor conduct ## Where Sub-processor Appears in Agreements Sub-processor clauses are a standard feature of data processing addenda attached to software as a service agreements, outsourcing contracts, and any arrangement where one party handles personal data belonging to another party's customers or employees. They are especially prominent in