A list is only useful if it stays current
Subprocessor pages are often created once and forgotten. That is where drift begins. A list that omits a major hosting provider, AI vendor, support platform, or analytics tool can create confusion for customers and reviewers.
The list should be tied to vendor onboarding and offboarding. When engineering, support, finance, or marketing adds a tool that may process customer personal data, the subprocessor list should be part of the launch checklist.
Include the fields customers need
A useful subprocessor list usually includes vendor name, service purpose, data processing role, location context, and links to relevant privacy, security, DPA, or subprocessor resources. Some teams also include the product area affected.
The goal is not to publish confidential architecture details. The goal is to give customers enough information to understand why the vendor is used and what kind of processing it supports.
Align with Article 28 commitments
Article 28 requires processors to manage subprocessors under authorization terms and to inform controllers of intended changes where general authorization is used, giving controllers an opportunity to object. Many SaaS subprocessor pages are built to support that workflow.
If customer contracts promise advance notice, the operational process must support it. Teams need a way to identify material vendor changes early enough to update the page, send notices, and handle objections where the contract allows them.
Do not mix every vendor into one bucket
Some vendors are subprocessors for customer data. Others may process only company employee data, marketing prospect data, or billing data where the role is different. Mixing every tool into a single list can make the disclosure noisy and less accurate.
A cleaner approach is to define the scope of the page. For example, it may cover subprocessors that process customer personal data in connection with the SaaS service, while the privacy policy separately describes other recipient categories.
Keep evidence behind the page
The public list should be backed by an internal register with contract owner, DPA status, transfer mechanism, security review status, data categories, systems connected, and renewal date. That internal evidence is what keeps the public page from becoming decorative.
When a vendor is removed, the team should also decide whether historical references are needed, how long data remains with that vendor, and whether customer notice is required. Offboarding is part of subprocessor management too.