# NoticeKit Free Subprocessor Change Checklist

Use this checklist before adding, replacing, or removing a subprocessor. It is an operational aid, not legal advice.

## 1. Identify the Change

- Vendor name:
- Vendor service or purpose:
- Addition, replacement, or removal:
- Planned effective date:
- Internal owner:
- Source URL or procurement ticket:

## 2. Confirm the Data Involved

- Data categories:
- Customer segment affected:
- Processing region:
- Transfer mechanism, if relevant:
- Security review status:
- Privacy review status:

## 3. Check Notice Requirements

- DPA or customer contract reviewed by counsel:
- Notice period:
- Objection deadline:
- Required notice recipient or channel:
- Customers excluded from notice:
- Special enterprise obligations:

## 4. Prepare Customer Notice

- Vendor name is clear.
- Purpose is specific.
- Data categories are understandable.
- Effective date is included.
- Objection instructions are included if applicable.
- Internal legal or privacy reviewer approved the draft.

## 5. Preserve Evidence

- Date notice was sent:
- Recipient list or customer segment:
- Public subprocessor page URL:
- Screenshot or page version saved:
- Sender or system used:
- Reviewer initials:
- Objection-window close date:

## 6. Close the Loop

- Objections reviewed:
- Customer follow-ups completed:
- Public subprocessor list updated:
- Internal vendor register updated:
- Evidence log archived:
- Lessons learned captured for the next change:

## Attorney Review Prompt

Ask counsel to confirm whether the planned notice content, timing, recipients, and objection process fit the relevant DPA, customer commitments, privacy notices, and applicable law.