My vendor uses sub-processors, how do I handle that properly?

Under GDPR you, the controller, are accountable for the full chain. The DPA must cover sub-processors, including notice and the right to object.

Try this first

1. 1Ask the vendor for the current sub-processor list with country of establishment and what each one does. Keep it with the contract.
2. 2Agree that the vendor notifies you in advance of any change, with a reasonable window to object.
3. 3Verify that the prime vendor flows the same obligations down to each sub-processor by contract. Ask for a sample DPA if needed.
4. 4Watch transfers: if a sub-processor sits outside the EEA, the legal basis (SCCs or EU-US DPF, for example) has to hold for that hop too.
5. 5Add the chain to your processing register so you can trace where data sat in case of a breach.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.