The Subprocessor Change Triage

A vendor just sent a subprocessor change notice: [PASTE THE NOTICE OR EMAIL]. Our context: [WHAT WE USE THEM FOR, WHAT DATA THEY TOUCH]. Do three things: (1) translate the notice into plain English - who is being added or removed, what they do, where they process data; (2) flag anything that changes our risk - a new country, a new data category, a subprocessor we already rejected elsewhere, or a conflict with our DPA: [PASTE RELEVANT DPA CLAUSE IF YOU HAVE IT]; (3) give me the call: accept silently, ask these specific questions, or invoke the objection clause - with the objection email drafted if so. This is triage, not legal advice; if the change touches regulated data or the DPA is ambiguous, say when counsel needs to look.