Why monitor a sub-processor list?

Because most DPAs give you a window to object to a new sub-processor, and that window starts when the vendor publishes, not when you notice. Watching the page turns a notification you may never receive into an alert you always do.

Should a privacy policy be watched in full or in part?

In full. Unlike a product page, a policy has no decorative parts, so a single reworded clause is exactly the signal you want and narrowing the watch risks missing it.

Can we prove what a vendor policy said when we signed?

From the day you start watching, yes. Each check stores a timestamped snapshot, so you can put the version that was live at signature next to the current one.

How often do these pages change?

Rarely, which is exactly why manual checking fails. A page you review quarterly can change the week after you look at it, and nothing tells you until it matters.

Can pages behind a customer portal be watched?

No. Only publicly readable pages can be monitored. Most sub-processor lists and privacy notices are public by design, because the obligation to publish them is what makes them work.

Sub-processor & privacy policy monitoring

What privacy and vendor risk teams monitor

Sub-processor lists

The change that is never announced. When a vendor quietly adds a sub-processor, you get the alert your DPA obliges you to act on, with the date it appeared.

12 sub-processors13 sub-processors

DPAs & data processing terms

Track the data processing agreements your contracts incorporate by reference, where a reworded clause changes an obligation without a countersignature.

Transfer mechanism: SCCsTransfer mechanism: SCCs + DPF

Privacy notices

Watch vendor and partner privacy notices in full. In a policy document there are no decorative parts, so a single changed sentence is the whole signal.

Retention: 24 monthsRetention: 36 months

EDPB & supervisory guidance

Follow guidance and opinion pages from the bodies that interpret GDPR, including the consultation drafts that precede a final position.

Draft for commentFinal version adopted

CCPA, CPRA & US state pages

Monitor the official pages for the state privacy regimes you fall under, plus the rulemaking pages that keep extending them.

Rulemaking openRules finalised

Vendor trust & security pages

Track the security and compliance pages your diligence relied on, so a lapsed certification or a removed control surfaces between annual reviews.

SOC 2 Type II · currentSOC 2 Type II · under audit

What the change alert looks like

One alert, showing the list as it stood and as it stands now, plus the snapshot your DPA objection window runs from.

vendor.example.com/sub-processors9 Aug, 11:40 UTC

Sub-processor table, row count

was12 sub-processors listed.

now13 sub-processors listed. One added: analytics, US.

Snapshot kept · previous version 8 Aug, 11:40 UTC

Guides to change monitoring

Regulatory change monitoring, explainedHow to build a watch list of regulators, standards bodies, and registers, and turn it into a process your auditors accept.

Monitor terms of service and policy changesWhy policy pages should be watched in full, and how the snapshot history becomes the audit trail.

The full guide to watching any page for changesThe general playbook: choosing what to watch, setting a cadence, and avoiding false alerts.

Sub-processor and privacy policy monitoring