Subprocessor
Also known as: Fourth party, Downstream processor, Sub-contractor (in data processing contexts)
A subprocessor is a third-party entity engaged by a data processor to perform specific processing activities on behalf of a data controller. They are contractually bound to provide the same level of data protection and security that the primary processor promised to the controller. The primary processor remains fully liable to the controller for the subprocessor's performance and compliance.
In practice
During an audit, practitioners review the "Subprocessor List" to verify that all third parties are disclosed and governed by a signed Data Processing Agreement (DPA). They check these lists against actual data flows to ensure no unauthorized fourth parties are handling sensitive information.