Subprocessor

A vendor that processes personal data on behalf of your processor (and thus indirectly on behalf of your controller customer).

A subprocessor is a processor engaged by another processor. Under GDPR Article 28, subprocessors must be contractually bound to the same obligations as the original processor, and controllers must be notified before new subprocessors are engaged. SaaS vendors publish subprocessor lists on their trust centres.