The sub-processor list is a webpage. You pre-approved everything that will ever appear on it.

Somewhere in your organisation there is a countersigned data processing addendum, and what it authorised was not a list of companies. It authorised subcontracting. Every supplier the platform has engaged since, and every one it engages next, is covered by that signature, including firms that did not exist when it was given.

This is not sharp practice. It is Article 28 of the GDPR working exactly as drafted, and it is the default setting of the entire enterprise software market.

Two ways to approve a subcontractor, and everyone picked the same one

Article 28(2) says a processor shall not engage another processor without the "prior specific or general written authorisation" of the controller. Two doors, and the whole story is which one your contract went through.

Specific authorisation means the platform names a company, you approve that company, and when it wants another one it comes back and asks. General authorisation means you approve subcontracting as a practice. The platform must then inform you of intended changes concerning the addition or replacement of sub-processors, and you get the opportunity to object.

Standard terms take the second door. They take it because it is the only one that scales to a hundred thousand customers, and because nobody negotiates it, and because the first door would mean a platform could not add a supplier without a purchasing decision in every organisation that buys from it. The reasons are good. The consequence is still that the approval was given once, in advance, for an unbounded set.

The builder and the board by the gate

You hire a builder for an extension. Under one contract you approve each subcontractor by name: the electrician, the roofer, the one who does the glass. Under the other you approve subcontracting in general, and the builder keeps the current list pinned to a board by the gate. Names go up. Names come down. You may object to any of them.

The board is where this analogy earns its place, because it takes weight at every joint.

Who is answerable when the roofer is careless? The builder. Article 28(4) says that where a processor engages another processor, the first one remains "fully liable" to you for the other's performance. Your contract is with the builder and the roofer is the builder's problem, which is the single most reassuring thing in the provision and the reason most people stop reading it there.

What binds the roofer? A contract you will never see. The same paragraph requires the same data protection obligations to be imposed on the sub-processor. It does not require anyone to show you that they were.Audit rights sometimes reach downwards. Whether yours do is a drafting question, and the answer is usually a summary report rather than the contract itself.

And what happens when you object? You may leave the site. That is the remedy the standard contract supplies, and by the time you would want it the extension is half built, the plant is hired and your people have learned the new system.

Three things Article 28(2) declines to say

The first is how much notice. The regulation says inform. It does not say thirty days, or fourteen, or before rather than after. That number lives in your contract, was written by the platform, and is one of the very few terms in the document a large customer can still move.

The second is what an objection does. The word appears in the text with no consequence attached to it. A processor is not told to stop, not told to pause, not told to reply. Contracts fill that vacuum, and what they fill it with is a right to terminate, which converts a legal objection into a commercial threat and prices it accordingly.

The third is who decides. There is no test for a good objection, no arbiter, and no requirement that anyone write back. We could not establish whether a supervisory authority has ever ruled on what an ignored objection obliges a processor to do.

The mechanism that put a model host into your processing chain is the same one that put a content delivery network there in 2019.

The clause is old. The list is not.

This obligation has read this way since 2018, and a reader who has been told four times that Article 28 has changed is entitled to ignore the fifth. It has not changed.

What changed is what the list is made of. A workplace tool that subcontracted hosting, mail delivery and error monitoring now subcontracts inference, and the inference supplier arrived through the noticeboard, in a window nobody diarised, under an authorisation given years earlier for something else entirely. No decision was taken on your side. The absence of an objection is what counted as one.

Two details are worth holding separately. The list is global and the objection right is not: a customer of the same platform in Ohio gets the same page with nothing behind it, which tells you what the page is for. And where a new sub-processor sits is a different question from whether it may be engaged at all, answered under Chapter V rather than Article 28, and never on the sub-processor page.

What is worth asking

Not whether the platform maintains a list. It does, and it is accurate.

Ask what the notice period is in your own addendum. Ask what your objection triggers, in the contract's own words, other than a right to walk. Ask whether the list is archived, because a page with no version history cannot tell you who was processing your data in March. And ask who receives the notification.

At most organisations that last one goes to a mailbox opened for the contract and read by nobody, which is a defensible arrangement right up to the morning somebody asks who approved the eleventh name.