Are you the controller, the processor, or a subprocessor?

The three roles, in one sentence each

• ControllerA controller decides why personal data is processed and how.
• ProcessorA processor processes that personal data on behalf of the controller.
• SubprocessorA subprocessor is another company the processor uses to process that same personal data.

GDPR Article 4 defines a controller as the one that determines the purposes and means of the processing, and a processor as the one that processes personal data on behalf of the controller. Article 28 says the processor needs the controller's prior written authorization before engaging another processor. A form often calls that other processor a subprocessor, sometimes written sub-processor.

This page does not decide which role you hold. Read whose data it is and who chose the vendor. If the setup is unusual, ask a lawyer.

A typical B2B product

Your customer decides why their people's personal data is in your product. They are the controller. You process that data to provide the product. You are the processor.

Hosting, email, support, and an AI provider that touch that customer personal data are subprocessors. They belong on the subprocessor list. A vendor that only touches your own company data, such as payroll, usually is not a subprocessor of that data, so it usually stays off the list.

You are the subprocessor when your customer is a processor. They handle personal data for their own customer, and they hired you to handle some of it. Their customer is the controller. The vendors you use that touch that data still belong on your list.

A quick test for the list

Put the vendor on the subprocessor list only when both answers are yes.

• Is this personal data your customer put in the product, or personal data about their people?
• Does this vendor receive it, store it, or have a way to read it?

If the vendor only sees data about your own company, the first answer is no. Leave it off the list you send that customer. A vendor that decides its own purposes for the data may be a controller in its own right, not your subprocessor. Write what it does, and ask a lawyer when the contract calls the vendor a controller.

Cases that do not fit the simple picture

• Your own marketing and billingFor a prospect list, or the card you charge for your own invoice, you decide why that data is used. You are the controller for that data, and the email or payment vendor is your processor. Those vendors stay off the subprocessor list you send a customer, unless the same vendor also receives personal data that customer put in the product.
• AnalyticsUse the same test. If the analytics vendor receives personal data about people in the product, put it on the list. If it only measures your own site and you do not send it customer personal data, leave it off. When the setup is mixed, write down what you actually send, and do not guess a role.
• A vendor's own subprocessorsList the company you chose. That company may hire its own vendors. Your list does not copy theirs. If a reviewer asks about a firm named on the vendor's list, open the vendor's page and answer from what you read. Keep that note with the review.

A vendor agreement may call you the controller. That heading is about the data you send them. It does not change your role toward your own customer. If the customer decides why the data is in your product, they remain the controller, you remain the processor, and the vendor remains a subprocessor.

Wording you can paste

Use this when it is true. Edit the brackets.

For personal data our customers put in the product, the customer is the controller and we are the processor. Vendors that process that personal data for us, including hosting, email, support, and any AI provider that receives it, are subprocessors on our list at [link], last checked [date]. Vendors that only process our own company data, such as payroll, are not on that list.

Point the reviewer at the same list, so the names in the sentence match the page or the table you send.

If the question is about your own marketing or billing data, say you are the controller for that data. Do not call those vendors subprocessors of the customer.

If you do not yet know whether a vendor can read customer personal data, say you are still checking, and leave it off the list until you know.

If you want the longer notes

Why reviewers ask for the list is in the vendor list guide.

A table you can copy, with the columns a reviewer expects, is in the subprocessor list template.

When a model provider belongs on that list, and how to describe it, is in the AI provider guide.

Whether customer data trains a model is a different sentence from listing the model company you chose. What to write is in the customer data training guide.

What to write for the data each vendor can see, once it belongs on the list, is in the data access guide.