---
title: "Sub-processor"
description: "A processor that another processor engages to carry out processing for a controller, such as the model host behind an AI vendor."
canonical: https://aigovernanceengineer.com/glossary/sub-processor
author: "Jorge García Aibar"
license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)"
doi: https://doi.org/10.5281/zenodo.22956197
version: "0.5.0"
updated: 2026-09-25
---

# Sub-processor

A processor that another processor engages to carry out processing for a controller, such as the model host behind an AI vendor. Under GDPR Article 28 it needs the controller's prior written authorisation, specific or general with notice of changes and a chance to object, and the same data protection obligations flow down to it by contract [1].

- Developed in: [ch. 19, AI vendor DPAs and no-training clauses](https://aigovernanceengineer.com/bok/privacy-and-ai#ai-vendor-dpas-and-no-training-clauses); [ch. 15, Vendor contracts and licence terms](https://aigovernanceengineer.com/bok/governing-deployment#vendor-contracts-and-licence-terms)
- Chapters: [ch. 08, Regulatory Map](https://aigovernanceengineer.com/bok/regulatory-map) · [ch. 12, Governance Program](https://aigovernanceengineer.com/bok/governance-program) · [ch. 15, Deployment](https://aigovernanceengineer.com/bok/governing-deployment) · [ch. 19, Privacy & AI](https://aigovernanceengineer.com/bok/privacy-and-ai)
- Contrast with: [Controller and processor](https://aigovernanceengineer.com/glossary/controller-and-processor)
- In the glossary chapter: https://aigovernanceengineer.com/bok/glossary#t-sub-processor

## Sources

[1] Regulation (EU) 2016/679 (General Data Protection Regulation) (Arts. 4(1), 4(5), 4(7), 4(8), 4(12), 4(14), 5, 6, 9, 12(3), 22, 25, 28(2) and 28(4), 30, 33, 35; Recital 26). Publications Office of the EU (EUR-Lex). 2016-04-27. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (verified: primary)