GDPR Article 28(2): the sub-processor notice, and a template

Last updated: September 6, 2026

Not legal advice — a plain-language starting point. Your DPA with each customer may set a stricter notice period or a different channel than the article itself requires; theirs governs.

What the article actually says

GDPR Article 28(2) lets a processor use sub-processors only with the controller's prior written authorization — general or specific — and, where that authorization is general, requires the processor to inform the controller of any intended changes concerning the addition or replacement of sub-processors, giving the controller an opportunity to object.

Three things fall out of that wording that are easy to miss:

It's triggered by intent — the notice is supposed to go out before the new sub-processor starts processing data, not as an after-the-fact FYI.
It only covers additions and replacements. A sub-processor's own sub-processors, or a change to what an existing one already does, isn't in scope unless your DPA says otherwise.
The article doesn't set a notice period. Most DPAs do (30 days is common) — that number comes from your contract, not from GDPR itself.

A template

Adjust the bracketed parts and the notice period to match your own DPA.

Subject: Notice of new sub-processor — [Your Company] Dear [Customer], In accordance with Article 28(2) of the GDPR and our Data Processing Agreement, we are writing to notify you of an intended change to our sub-processors used in providing [Service Name]. Sub-processor: [Vendor name] Purpose: [What it does — e.g. "email delivery", "cloud hosting"] Location of processing: [Country/region] Effective date: [Date, no earlier than [notice period] from this notice] If you wish to object to this sub-processor, please contact us at [contact email] within [notice period] of this notice, stating your grounds. We will work with you in good faith to address a reasonable objection. [Your Company]

Where the work actually is

Writing the notice is the easy part. The hard part is knowing a change happened — every vendor you depend on publishes its own sub-processor list, on its own page, updated on its own schedule, with no ping to tell you. Checking those pages by hand, across every vendor you use, is the part that quietly stops happening after the first quarter.

That's the specific gap TrustPages closes: point it at the sub-processor pages you depend on, and it re-checks them daily, tells you when one changed and whether the change looks material, and drafts the Article 28(2) notice above — filled in — for changes you approve. You still send it; we do the watching and the first draft.

Our own sub-processor list, kept the same way, is at our public trust page if you want to see the output before trying it.