Are SaaS vendors required to publish sub-processor lists?

GDPR Article 28(2) requires that processors obtain authorization for sub-processors and provide controllers with information about sub-processors. Most B2B SaaS vendors operating under the general-written-authorization model satisfy this requirement minimally — typically by listing sub-processors in an appendix to a downloadable Data Processing Agreement that customers must explicitly retrieve. Equivalent state-law requirements have emerged in California, Virginia, Colorado, and other US jurisdictions.

Sub-Processor Transparency in SaaS: A Survey of 30 Vendors

Methodology

This audit examined 30 widely-used B2B SaaS vendors across the following categories: customer relationship management, customer support, communication, analytics, productivity, infrastructure, and developer tools. For each vendor, the audit attempted to locate the sub-processor list using only public surfaces, without filing a support ticket or engaging the vendor's sales team. The audit was performed in early 2026.

Each vendor was assigned to one of four disclosure categories based on the structure of the publication.

Distribution of disclosure formats

Linked page (8 vendors, 27 percent)

The vendor maintains a dedicated page at a stable URL (commonly /subprocessors, /sub-processors, or /trust/subprocessors). The current sub-processor list is displayed directly on the page. A last-updated date is visible, and several vendors in this category publish a changelog of additions and removals.

This is the format with the lowest discovery cost and the highest support for change monitoring. Vendors in this bucket include several major payments, infrastructure, and communication providers.

DPA appendix (14 vendors, 47 percent)

The vendor publishes a Data Processing Agreement template as a downloadable PDF. The sub-processor list is included as an appendix (commonly "Appendix 2," "Annex IV," or "Schedule 3"; nomenclature is not standardized). To locate the list, a reviewer must:

Identify the DPA template page, typically linked from the Trust

Center or the privacy policy footer.

Download the PDF.
Scroll to the appropriate appendix.

PDFs in this format frequently lack an internal version date. Versioning is sometimes accomplished by replacing the file at the same URL, which means a customer's local copy may diverge from the current published version without notification.

Support ticket required (4 vendors, 13 percent)

The vendor references sub-processors in the privacy policy or DPA text as "available on request" or equivalent. To retrieve the list, a customer must file a support ticket or contact the sales team. Reported response times range from days to several weeks.

This format is technically compliant with GDPR Article 28(2) under several interpretive frameworks. It is operationally compliant only if the customer maintains an active retrieval cadence.

Not documented (4 vendors, 13 percent)

The vendor does not publish a documented sub-processor list on any public surface. The privacy policy references "industry-standard sub-processors" or "trusted third-party providers" without naming them. This format is not compliant with several interpretive frameworks of GDPR Article 28(2). Customers in regulated industries working with vendors in this category typically negotiate a contractual sub-processor disclosure as a condition of contract execution.

Implications for customer compliance

For customers operating under GDPR or equivalent state law, the distribution of disclosure formats produces operational friction:

Heterogeneous discovery workflow: A customer with twenty

vendors must apply four different discovery workflows to maintain a current sub-processor inventory.

Change detection cost: For vendors using the DPA appendix

format, change detection requires periodic re-retrieval of the PDF and comparison against a stored prior version. This is meaningfully more expensive than checking a versioned web page.

Notification gap: Vendors operating under the

general-written-authorization model are required to notify customers of sub-processor changes. Notification compliance varies; in practice, customers cannot rely on notification as the primary detection mechanism.

Recommendations

For TPRM programs that must maintain current sub-processor inventories:

Treat "available on request" as a yellow flag. Vendors that

gate sub-processor disclosure exhibit a documented disclosure posture that warrants additional scrutiny.

Establish a 90-day re-validation cadence. Quarterly

re-retrieval is sufficient to capture material changes within an acceptable window without producing excessive workload.

Diff systematically. The detection value of re-retrieval is

realized through diff against the prior version. Manual diff is feasible for short lists; longer lists benefit from automated tooling.

Document the disclosure format in the vendor risk file. The

format itself is a control characteristic of the vendor and should be documented for audit purposes.

Automated TPRM workflows perform the retrieval, diff, and summarization steps without proportional analyst time, which is typically the practical path for organizations with twenty or more vendors in scope.

See sub-processor monitoring in action →

Editorial note: This article is published for informational purposes and reflects the authors' analysis of publicly available information, industry surveys, and aggregated, anonymized data from the Vensider.io platform. It is not legal, compliance, or audit advice. Regulatory references (GDPR, HIPAA, SOC 2 TSC, ISO/IEC 27001, NIST CSF) are general and should be interpreted in the context of your organization's specific obligations. Vendor names referenced herein are used to illustrate general industry patterns; no statement should be read as a claim that a specific vendor is non-compliant unless explicitly cited with a primary source.