Article 28 Sub-Processor Chains: The Hidden UK GDPR Risk in Every Cloud AI Deployment | Insights

When your firm signs a DPA with Microsoft for Copilot, you are not signing a bilateral agreement with a single processor. You are inheriting a sub-processor chain that spans dozens of entities, multiple jurisdictions, and — since January 2026 — includes Anthropic as a default-enabled AI sub-processor excluded from the EU Data Boundary and in-country processing commitments. Your Compliance Officer did not approve Anthropic. Your DPIA did not assess Anthropic. But Anthropic may already be processing your client data.

For the full Data Processor liability analysis for AI vendors under UK GDPR, read our parent article. This piece maps the sub-processor exposure of cloud AI deployments against the radically simplified processor architecture of a bare-metal sovereign deployment.

What Article 28(2) Requires

UK GDPR Article 28(2) prohibits a processor from engaging a sub-processor without the controller’s authorisation. Where general written authorisation is given (as is standard in enterprise DPAs), the processor must inform the controller of any intended changes — additions or replacements — giving the controller an opportunity to object.

This creates an ongoing operational obligation for the firm. Every sub-processor change requires review. Every new entity in the chain must be assessed for data handling practices, jurisdictional exposure, and international transfer compliance. Every change that introduces unacceptable risk must be objected to — and that objection must be documented.

Most firms treat the initial DPA signing as the end of the procurement process. Under Article 28(2), it is the beginning of a perpetual monitoring obligation.

The Cloud AI Sub-Processor Map: A Moving Target

Microsoft 365 Copilot

Microsoft’s sub-processor list is published on the Service Trust Portal. It runs to dozens of entities spanning the United States, the European Union, and other jurisdictions. For Microsoft 365 Copilot specifically, the processing chain includes:

Microsoft Corporation — primary processor under the DPA
Anthropic — onboarded as a Microsoft sub-processor from January 2026 for Copilot experiences including Agent Mode in Word, Excel, PowerPoint, the Researcher tool, and Copilot Studio. Anthropic models are excluded from the EU Data Boundary and in-country processing commitments. For UK tenants, the toggle defaults to off — but any admin who enables it extends the sub-processor chain to a US AI company processing data outside the firm’s expected geographic boundary
Azure infrastructure sub-processors — data centre operators, managed services providers, and support subcontractors across Microsoft’s global infrastructure

Microsoft’s DPA provides general written authorisation for sub-processor changes. Microsoft publishes updates. The firm has the right to object. But the volume and frequency of changes to a global sub-processor list — across a platform serving hundreds of millions of users — makes meaningful per-change assessment impractical for a 30-person Scottish law firm.

OpenAI (ChatGPT Enterprise)

OpenAI’s sub-processor list includes cloud infrastructure providers (primarily Microsoft Azure), content moderation vendors, and operational support entities. OpenAI’s data residency expansion allows data storage at rest within geographic regions, but the sub-processor chain for inference, abuse monitoring, and platform operations extends across OpenAI’s global footprint. Each sub-processor requires the firm’s compliance assessment.

Google (Gemini for Workspace)

Google’s sub-processor ecosystem is among the largest in the industry, spanning Google’s global data centre network, infrastructure partners, and support operations. Gemini for Workspace inherits this entire chain. Google publishes sub-processor updates; the firm must monitor and assess each one.

The Common Pattern

In every case, the sub-processor map is:

Large — dozens of entities
Global — spanning multiple jurisdictions, triggering Chapter V international transfer obligations
Dynamic — changing regularly as vendors add capabilities, switch infrastructure providers, and onboard new AI model partners
Opaque — published at a level of abstraction that makes it difficult for a mid-sized professional services firm to conduct meaningful due diligence on each entity

The firm’s Compliance Officer must maintain a register of every sub-processor, assess each one’s data handling, verify international transfer mechanisms for every jurisdiction, and document objections where risk thresholds are exceeded. This is the operational reality of Article 28(2) compliance for cloud AI.

The Sovereign AI Sub-Processor Map: One Entry

A bare-metal sovereign AI deployment with Private AI Ltd’s Zero-Touch Provisioning model produces an entirely different processor architecture. The complete sub-processor map at the AI layer contains exactly one entity:

UK bare-metal infrastructure provider (UK-registered, directly contracted by the client)

Role: Provides bare-metal compute and hypervisor-encrypted block storage
Jurisdiction: United Kingdom. Infrastructure located exclusively within UK data centres
DPA: Domestic Article 28 UK GDPR agreement. No international transfer mechanism required. No Standard Contractual Clauses. No adequacy assessment
Relationship: Direct Data Processor to the client. The client contracts the infrastructure provider independently
Sub-processors: The infrastructure provider’s own sub-processor list — materially smaller than any hyperscaler, confined to UK data centre operations

The self-hosted access layer — through which all user sessions are authenticated — is client-controlled infrastructure. It introduces no additional processor, no additional DPA, and no international transfer exposure.

Private AI Ltd acts as a Standing Data Processor under Article 4(8) UK GDPR (Company No. SC881079), operating under a Zero Standing Privileges architecture. The standing Data Processing Agreement is operative continuously from signature — but in the Default Operating State, Private AI Ltd holds no active connection, no credentials, and no means of accessing Client systems. Private AI Ltd does not appear in the client’s sub-processor chain with the infrastructure provider. Active processing is strictly limited to authorised Just-In-Time Support Sessions conducted under Schedule 2 of the standing DPA.

The pre-filled DPA template is delivered alongside the Standing DPA, DPIA template, and Data Flow Narrative. The firm’s Compliance Officer reviews one agreement. Not forty pages of Microsoft addenda. Not a global sub-processor registry. One agreement, one processor, directly contracted.

The Compliance Arithmetic

Consider the annual compliance burden for each model:

Cloud AI: Monitor sub-processor lists across 1–3 vendors. Assess each sub-processor change. Verify international transfer mechanisms for every jurisdiction in the chain. Update the DPIA for each material change. Maintain Article 30 entries for every processor and sub-processor. Document objections. Reconcile vendor DPA updates with firm policies. Repeat quarterly, at minimum.

Sovereign AI: Single processor. Entirely domestic. No transfer assessment required. Article 30 entries: one. DPIA: one document, updated only if the architecture changes — which it does not, because the architecture is bare-metal, not a cloud service subject to feature releases.

The compliance burden of sovereign AI is not lower. It is categorically different. The firm’s data governance is not simpler because it has a better vendor. It is simpler because the vendor category that creates the complexity has been removed from the architecture.

Talk to our team to review the compliance documentation set — the pre-filled DPA templates, the GDPR Article 30 data flow map, and the Technical Configuration Letter confirming Private AI Ltd’s Zero Standing Privileges architecture and the Default Operating State.

Private AI Ltd (SC881079)