---
name: "subprocessor-register"
description: "Keep a register of subprocessors with service, data, location, contract, and last check."
triggers: ["subprocessors", "vendor list", "third parties", "subprocessor page", "data processors"]
version: "1"
---
# Subprocessor register
Use this to build the register or to check it against contracts and vendors.
## Gather from contracts
Collect signed contracts and DPAs, the finance list of paid vendors, and each
vendor's own subprocessor page. Note any vendor that touches personal data but
has no signed DPA, and any page you could not reach.
## Build the register
For each subprocessor record:
- legal name and service provided;
- personal data it receives, and whose;
- processing locations, as the vendor states them;
- contract and DPA, with dates and where they are filed;
- transfer mechanism, if the contract names one;
- the date you last checked, and the source.
Record what the documents say. When a vendor page and the contract disagree,
show both and mark it for the owner.
## Changes to announce
Compare with the last published list. Give additions, removals, and changes in
location or data. If customer contracts require notice before a change, list
the notice period and the date it runs out, from the contract text.
Never add a location, DPA, or transfer mechanism the documents do not show.
This is not legal advice. Do not publish the page or send notices; the owner
approves and sends.