A sub-processor is a third party engaged by a data processor to process personal data for the processor or its controller. In generative marketing, an AI provider may become a sub-processor when it receives personally identifiable information (PII). section 9.3.4
Treating an AI service as a potential sub-processor creates practical governance obligations:
- Consult compliance teams before adopting capabilities that send organizational data to third-party providers. section 9.3.4
- Confirm that security and compliance teams accept the data shared with the service. section 9.3.4
- Consult legal teams about privacy requirements and intellectual property generated by AI models. section 9.3.4
Generative marketing provider
A marketing capability that sends PII to OpenAI or Google Cloud may need to list the provider as a sub-processor and obtain security and compliance approval. section 9.3.4
