A supplier raises a fee, moves data to a new region, or adds a sub-processor. The change is a paragraph on a web page. Nobody emails you, or the email goes to a mailbox no one reads. Six months later you are asked what you agreed to, and the page now says something else.
If you are a controller under data protection law, the sub-processor case matters most, because you may have a short window to object. This article covers what to watch, how to keep a dated copy, and how to notice a change while it still matters.
Why the live page is the wrong record
A supplier's terms are usually a set of pages: the main terms, a data processing addendum (DPA), an acceptable use policy, a service level agreement, a security page and a list of sub-processors. The supplier can edit any of them. Your signed order form may say "the terms at this address apply", and the address will show today's version, not the one in force on the day you signed.
Whether a later edit binds you depends on your contract and the law that governs it. Read how your contract incorporates the terms and what it says about changes. Whatever it says, you are in a stronger position if you can show the version you saw, the date you saw it, and the date it changed.
The sub-processor rule, in one paragraph
Under the EU GDPR, a processor must not engage another processor without the controller's prior specific or general written authorisation (Article 28(2)). Where you have given general authorisation, the processor must inform you of any intended changes concerning the addition or replacement of other processors, giving you the opportunity to object. The UK regulator describes the same duty under UK GDPR: the processor should let the controller know of any intended changes and give the controller a chance to object.
The text of Article 28(2) sets no number of days. The length of the objection period, and how the supplier tells you, come from your contract. Some suppliers publish a list and offer a notification sign-up. Check which your contract describes. A change you did not hear about is still a change, and the page is where you can find it.
What to watch
Not every page needs the same attention. Start with the documents that change your obligations or your risk.
| Document | Why it matters | Starting interval |
|---|---|---|
| Sub-processor list | Triggers any right to object | Weekly |
| Data processing addendum | Sets the processing terms and the notice period for changes | Monthly |
| Main terms and order terms | Fees, liability, termination, how changes are notified | Monthly |
| Pricing page | Evidence of the price you were quoted | Weekly |
| Service level agreement | Uptime commitments and credits | Monthly |
| Security and data location pages | Claims you may have relied on in your own due diligence | Monthly |
These intervals are a starting point. How often to capture a page explains how to set them from what a missed version would cost you. Raise the frequency for any supplier that holds personal data or that you cannot easily replace.
How to keep the record
1. List your suppliers and rank them
Write down each supplier, what it does for you and what data it touches. Rank them. A payroll processor and a stationery supplier do not need the same treatment. Ten suppliers tracked properly beat a hundred tracked in name only.
2. Find the exact addresses
Open your contract and note every URL it refers to. Terms are often split across several pages, and the DPA and sub-processor list are frequently on addresses that are not linked from the main terms. Add the version number or "last updated" date shown on each page to your list.
3. Capture the day you sign
Save every page in the set on the day you accept, before you start using the service. That copy is the baseline against which every change is measured. Record who captured it and why. Our chain of custody guide lists what to log.
4. Capture on a schedule
Pick intervals from the table and keep each capture as its own dated file. Overwriting last month's copy with this month's destroys the history you wanted.
5. When something changes, compare and decide
Compare the new capture with the one before it as text, and read the changed lines in context. Comparing two versions of a page shows how to do it and how to write up the result. Then write down three things: what changed, when you first saw it, and what you decided. If the change is a new sub-processor, check the date against the objection period in your contract on the same day.
6. Keep the set together
File the baseline, the changes and your notes under the supplier's name. When someone asks what the terms said on a given date, you open one folder rather than reconstruct it from memory. The same method works for your own documents, as in keeping a dated record of your privacy policy and terms.
What a capture cannot do
A capture of a public page shows what that page said to the public. It does not show terms in a customer portal behind a login, or terms negotiated for you alone. For those, ask the supplier for a dated copy and file it with the rest.
A page also shows what the supplier published, not whether you were notified. Keep the notice itself, if one arrives.
How Archivepanel helps
Archivepanel captures public pages, one page at a time, without logging in. Each capture is a self-contained HTML file with a preview, a plain-text version, a WARC file and a manifest, and it carries a DigiCert RFC 3161 timestamp that you can verify with OpenSSL. The timestamp is not an eIDAS qualified timestamp.
- Capture each supplier page by hand on signing day, with a tag for the supplier and a note on why you saved it. The free tier has 100 MB of storage.
- On the paid plan, a schedule captures a page at the interval you choose, and keeps every snapshot unless you set a limit.
- Any two captures of an address can be compared as text, older against newer. The documentation describes the view.
- On the paid plan, team members can share one workspace, so the record does not live on one person's laptop.
It does not read a change and tell you whether it matters. That judgement, and the decision whether to object, stay with you.
Sources
- GDPR, Article 28: Processor, paragraphs 2 and 4.
- Information Commissioner's Office, What needs to be included in the contract?.