Under a general authorization, a supplier must inform you of intended sub-processor changes and give you an opportunity to object. Most organizations never exercise that right, and a good number would not know how to if they decided to. This article sets out what to do when a change arrives that you are not prepared to accept: how to assess it, how to raise the objection, what remedies realistically exist, and what to record.
The upstream mechanics are covered elsewhere. How the two authorization models differ is in our article on general and specific authorization, and how notices are delivered and missed is in subprocessor change notifications.
The clock starts before you read the notice
The objection window in most contracts runs from the date of notification or publication, not from the date someone in your organization reads it. If notices arrive at an unmonitored mailbox, or on a page you were expected to check, a meaningful part of your window is gone before the assessment starts.
Two practical consequences follow. First, the operational work of objecting is mostly work you do before any objection arises: making sure notices reach a monitored, role-based destination. Second, when a notice does arrive, treat the window as shorter than it says.
Assess before you object
An objection is a contractual step with commercial consequences, so it should follow an assessment rather than a reflex. Four questions usually settle it.
Does this change affect our data?
Suppliers serve many customers and publish changes that apply to product lines or regions you do not use. Establish whether the new sub-processor sits in the path of your processing at all. A material proportion of alarming-looking notices resolve here.
What does it change about the transfer position?
If the new entity is in a third country, identify the mechanism relied on and whether your existing assessment covers it. This is the most common substantive ground for concern, and our transfer impact assessment guide covers the analysis. If the destination is already covered by your assessment, the change may be recordable rather than objectionable.
What does it change about access?
A sub-processor that stores encrypted data it cannot read presents a different question from one whose staff can open records. Ask what the entity actually does.
Does it conflict with commitments we have made?
You may have told your own customers, in a contract or a published list, which processors and destinations you use. A change upstream can put you in breach downstream, and that is an objection ground with concrete consequences.
Grounds that hold up
Article 28(2) of the General Data Protection Regulation (GDPR) does not enumerate grounds, and most contracts require objection on reasonable data protection grounds. In practice the grounds that carry weight are:
- The change creates a transfer you cannot support with an appropriate mechanism.
- The proposed entity's guarantees are insufficient for the sensitivity of the data.
- The change conflicts with commitments you have given your own customers or regulator.
- The disclosure is inadequate: you cannot assess the change because the supplier has not identified the entity, its role, or its location.
That last ground is often the strongest available and the least used. If you cannot assess, you cannot approve, and asking for the information is a reasonable first step that also stops the clock in many drafting patterns.
Commercial preference is not a data protection ground. Objecting on grounds you cannot articulate weakens your position on the changes that matter.
How to raise it
Keep it short, factual, and in the contractual channel:
- Reference the notice, its date, and the specific change.
- State the ground precisely, in data protection terms.
- Say what you are asking for: information, an alternative, an exclusion from the change, or a delay pending assessment.
- Give a date by which you need a response.
- Send it to the contractual notice address, not only to your account manager.
Asking for information rather than immediately demanding an alternative is usually the more effective opening, because it is easy for the supplier to satisfy and it establishes a documented exchange.
What remedies actually exist
Standard terms typically provide that the supplier will use reasonable efforts to make an alternative available, and that if it cannot, you may terminate the affected service. Understand what that means for you before you rely on it.
For a peripheral service, termination is a real option. For a deeply embedded platform, it is not, and everyone in the negotiation knows it. Where termination is not credible, the realistic outcomes are:
- The supplier provides information that resolves the concern.
- The supplier offers a regional configuration that avoids the change.
- The supplier excludes your tenant from the change, which is uncommon but not unknown for larger customers.
- You accept the change and record the reasoning, including any compensating steps.
The last outcome is legitimate. An objection that ends in documented acceptance is not a failure; an unexamined change is.
Record the decision either way
Whatever the outcome, the record is the point. Retain the notice as received, the assessment, the objection if made, the supplier's response, the final decision, its owner, and the date. Capture the supplier's disclosure as it stood, since the page will move on.
That record is what demonstrates that the authorization model actually operated. Our article on audit-ready vendor evidence covers the standard, and evidence retention covers how long to hold it.
Frequently asked questions
What happens if we miss the window?
The change generally takes effect. You can still raise the issue, and a supplier may engage, but you are negotiating rather than exercising a right. Update the record to reflect the new position and treat it as an input to the next review.
Can we object to every third-country sub-processor?
You can, but a blanket position invites a blanket response, usually that the service cannot be provided. A targeted objection tied to your data and your assessment is more likely to produce movement.
Does objecting put the contract at risk?
Rarely on its own. Suppliers expect objections from regulated customers. What damages the relationship is objecting without grounds or without a decision-maker behind it.
Who should sign the objection?
Someone with contractual authority, copied to the relationship owner. An objection from a reviewer with no mandate tends to be handled as a query.
Where DPAFlow fits in
The objection right is worth exactly as much as your ability to notice the change in time. DPAFlow checks vendor sub-processor lists, Data Processing Agreement pages, and trust-center pages on a scheduled, recurring basis, records what changed with dated evidence including captured page text and change differences, and sends email alerts so the change reaches a monitored destination. Detected changes enter a review workflow where your team assesses the change and documents its decision.
DPAFlow does not draft objections, does not decide whether grounds exist, and does not provide legal advice. It closes the gap between publication and awareness. The workflow is described on the product page.
This article describes a contractual process in general terms. It is not legal advice, and objection decisions belong to your counsel.