GDPR Article 28: you have a window to object when a vendor swaps subprocessors — here's how it works

Here's the short version: under GDPR Article 28, your vendor generally can't quietly swap in a new subprocessor. It has to give you notice and a fair chance to object before the new party starts processing your data. If you object and the vendor can't resolve your concern, you usually have the right to terminate. The catch most teams miss is timing — the clock starts when the vendor posts the change, not when you happen to notice it.

This post explains where that right comes from, how the objection window actually works, and what to do inside it. It's a plain-English walkthrough, not legal advice — for your specific situation, talk to a qualified professional.

What Article 28 actually requires

Article 28(2) says a processor must not engage another processor (a subprocessor) without the controller's authorization. In practice, DPAs handle this in one of two ways:

• General (or "blanket") authorization: you approve the vendor's current list, and the vendor commits to notify you of any intended additions or replacements in advance, giving you the chance to object.
• Specific authorization: the vendor must get your explicit sign-off for each new subprocessor before using it.

Most modern SaaS DPAs use the general model — it scales better for the vendor. That's why the published subprocessor list and the notice mechanism matter so much: they are the entire basis on which you've agreed to let data flow downstream.

How the objection window works

When a vendor plans to add or change a subprocessor, it notifies customers — often by updating its subprocessor page, sometimes by email, sometimes both. That notice opens a window during which you can raise an objection. The length is set by your contract; a period around 30 days is common, but the only number that matters is the one written in your DPA. Read that clause and know it in advance.

If you do nothing before the window closes, you're generally deemed to have accepted the change. That's the quiet failure mode: no alarm goes off, the new subprocessor goes live, and your records still show the old list.

What "objecting" actually looks like

Objecting isn't dramatic. It usually means emailing the vendor's privacy or account contact, naming the subprocessor and your concern (data location, a competitor, a sub-processor with a poor track record), and asking how they'll address it. From there a few things can happen:

• The vendor offers a workaround — a different region, an alternative provider, or an exclusion for your account.
• The vendor explains why the subprocessor is necessary and you decide the risk is acceptable.
• You can't reach agreement, and you exercise your right to terminate the affected service without penalty, as most DPAs allow.

A practical checklist

• Find and save each key vendor's subprocessor URL and the objection-period length from its DPA.
• Decide in advance what would actually trigger an objection for your organization (regions, categories of processor, named competitors).
• Make sure notices reach a person, not an unmonitored inbox — vendor emails get filtered, and page updates come with no email at all.
• When a change lands, log it: what changed, the date you saw it, and your decision. That log is exactly what an auditor wants to see.

The part that's genuinely hard

None of this works if you don't see the change. A window you never knew opened is a window you never used. Watching one vendor is easy; watching a dozen, across pages that update without warning, is the task that quietly falls off everyone's plate.

That's the gap DPA Monitor fills. Pick your vendors and we watch their subprocessor lists and DPAs for you, then email you a plain-English summary the day something changes — while your objection window is still open. We report the change and link the official source; we don't interpret its legal meaning.