The document lists each third-party sub-processor by name, the category of service they perform for Snowflake, and the country or region where data processing takes place, providing the foundational transparency disclosure required under data processing agreements.
This analysis describes what Snowflake's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision satisfies the sub-processor transparency obligation asserted under GDPR Article 28, enabling enterprise customers to identify which vendors receive or handle their data and in which jurisdictions, which directly informs customer data mapping, vendor assessment, and Records of Processing Activities obligations.
Interpretive note: The document was truncated in the source HTML, so the complete list of sub-processors, their specific service descriptions, and processing locations could not be fully verified from the provided text.
The document establishes the identity, function, and processing location of each authorized sub-processor, providing enterprise customers with the information necessary to assess third-party data handling as part of their own compliance obligations. Under these terms, customers can determine which vendors access their data and where that processing occurs geographically.
Cross-platform context
See how other platforms handle Sub-processor Identity and Service Disclosure and similar clauses.
Compare across platforms →Monitoring
Snowflake has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 28, which requires processors to make sub-processor identities available to controllers and to obtain controller authorization before engaging sub-processors. It also interacts with UK GDPR equivalent obligations. Enforcement authority rests with EU supervisory authorities and the UK ICO. Where the provision discloses sub-processors operating in non-adequate third countries, it may require evaluation under GDPR Chapter V transfer mechanism requirements. (2) GOVERNANCE EXPOSURE: Medium. The disclosure of sub-processor names, service categories, and processing locations creates a verification obligation for enterprise customers: they must confirm that each disclosed sub-processor is covered by appropriate contractual protections and, where applicable, international transfer mechanisms. Failure to maintain updated vendor assessments in line with this list may create compliance gaps under GDPR Article 30. (3) JURISDICTION FLAGS: EU and EEA customers face the highest exposure, as GDPR Article 28 imposes affirmative obligations on controllers to authorize sub-processors and ensure adequate safeguards. UK customers are subject to equivalent UK GDPR requirements. California customers subject to CCPA/CPRA should assess whether disclosed entities qualify as service providers or third parties under that framework. Customers in regulated sectors such as healthcare or financial services may face additional data residency or sovereignty constraints based on the processing locations listed. (4) CONTRACT AND VENDOR IMPLICATIONS: This list is a trigger document for procurement and vendor assessment workflows. Enterprise customers should confirm their DPA with Snowflake includes a defined notice period for sub-processor additions and a documented objection procedure. The list itself does not specify the contractual mechanism by which sub-processor authorizations are granted or modified, creating a dependency on the governing DPA for operational completeness. Procurement teams should assess whether newly listed sub-processors require independent vendor due diligence under their internal policies. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a version-controlled record of this list to detect additions or removals of sub-processors over time. Any new sub-processor operating in a non-EEA or non-UK country should trigger a transfer impact assessment review. Organizations subject to sector-specific regulations should cross-reference processing locations against applicable data residency requirements. DPAs should be reviewed to confirm whether the customer has a time-limited right to object to new sub-processors before they are engaged.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision satisfies the sub-processor transparency obligation asserted under GDPR Article 28, enabling enterprise customers to identify which vendors receive or handle their data and in which jurisdictions, which directly informs customer data mapping, vendor assessment, and Records of Processing Activities obligations.
The document establishes the identity, function, and processing location of each authorized sub-processor, providing enterprise customers with the information necessary to assess third-party data handling as part of their own compliance obligations. Under these terms, customers can determine which vendors access their data and where that processing occurs geographically.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Snowflake.