The DPA Monitor blog
Practical guides to watching your vendors' fine print — subprocessors, DPAs, and the reviews auditors actually ask for.
- Sep 5, 2026· 4 min read· DPA Monitor team
What is a subprocessor? A plain-English guide (with real examples)
A subprocessor is a third party your vendor uses to process your data. Here's what that means in practice, why a change to the list matters, and how to find any vendor's subprocessor page.
Read → - Sep 5, 2026· 3 min read· DPA Monitor team
GDPR Article 28: you have a window to object when a vendor swaps subprocessors — here's how it works
When a vendor adds or replaces a subprocessor, GDPR Article 28 usually gives you a window to object before the change takes effect. Here's what the right actually is, how the clock works, and what to do with it.
Read → - Sep 5, 2026· 3 min read· DPA Monitor team
The vendor review that SOC 2 auditors actually ask for (checklist inside)
SOC 2 auditors don't want a giant spreadsheet — they want proof you know your vendors, review them, and can show when. Here's the vendor review that satisfies them, with a checklist you can copy.
Read → - Sep 5, 2026· 3 min read· DPA Monitor team
How to monitor a vendor's DPA for changes (manual ways, and the lazy way)
A vendor's data processing agreement can change without a word. Here are the honest options for catching it — from a bookmark and a reminder to change-detection tools to a purpose-built watch — and where each one breaks down.
Read → - Sep 5, 2026· 3 min read· DPA Monitor team
Your vendor added an AI subprocessor. Now what?
A vendor just added an AI provider to its subprocessor list — usually to power a new feature. Here's a calm, practical way to assess it, decide whether to act, and document it — without overreacting.
Read → - Sep 5, 2026· 2 min read· DPA Monitor team
What DPA Monitor watches — and why a subprocessor change matters
A plain-English tour of the vendor documents we monitor, and why an added subprocessor is the change compliance teams most need to catch.
Read →