A subprocessor list from a PR supplier for Dutch buyers in 2026: what to ask for before signing

By Bram Osseweijer · Last edited 4 September 2026 · 7 min

What is a subprocessor list and why does a Dutch PR buyer need one in 2026?

A subprocessor list is a document from a supplier that names every outside company that touches your data. For a PR tool that stores journalist contacts or sends press releases, the subprocessors might include a cloud host, an email delivery service, or an analytics provider. Under the GDPR, a Dutch buyer must know where their data goes and who can access it.

Without a list, you cannot check if the supplier follows the law, especially when data moves outside the European Union. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) expects you to do this check before signing a contract. The subprocessor list is the first place to look.

Which PR suppliers publish a subprocessor list for their Dutch and Flemish services in 2026?

PR-Dashboard, a Dutch platform from Amsterdam (Herengracht 450), states that all development and hosting take place in the Netherlands with Dutch programmers, as noted on its FAQ page measured 1 September 2026. De Perslijst, its journalist database and sending system, costs EUR 2,650 per year for two logins, and the product pages list the same price without a separate setup fee.

PR-Dashboard does not document a subprocessor list on the pages we measured, 1 September 2026. Among the measured competitors, Prezly hosts on AWS eu-west-1 in Dublin, as stated on its pages measured 31 August 2026, but Prezly does not mention a subprocessor list either. Presspage names Germany as its data location on its plans page, measured 31 August 2026, but again does not document a subprocessor list.

Mynewsdesk publishes no Dutch-language pages at all; its five language editions are German, English, Swedish, Norwegian and Danish, measured 31 August 2026, so a Dutch buyer would need to ask about subprocessors directly. The absence of a documented subprocessor list is common across these suppliers, which means the buyer must ask for it in the contract.

What should a Dutch buyer ask for in a subprocessor list before signing a PR software contract?

A buyer should ask for the full name of each subprocessor, the service it provides, and the country where it stores or processes data. The list must also state the legal basis for each transfer, for example, an adequacy decision by the European Commission or Standard Contractual Clauses. The supplier should agree to notify you before adding or changing a subprocessor, and give you time to object.

For a PR tool that covers the Netherlands and Flanders, like De Perslijst which holds a database of thousands of Dutch and Belgian journalists covering virtually all media in the Netherlands and Flanders, the subprocessors might include an email sending service that operates from servers in the United States. Without a clear list, you cannot know if the data stays within the European Economic Area.

The supplier should also state whether the subprocessor has access to personal data or only to anonymised or encrypted data.

How does the cost per user per year compare among suppliers that document a price for Dutch and Flemish PR tools?

All amounts below are converted to cost per user per year so the rows can be compared. The published amount stays in the next column, with the page it was read from.

5 columns. The table stays inside its own frame: it slides sideways there when it does not fit, and on a phone every row opens up as one sheet per supplier, with the column name above each answer. The page itself never moves.

That database costs EUR 1,325 per user per year for two logins, which is the second lowest on this axis after Prezly Essential at EUR 1,200 per user per year. Prezly hosts on AWS eu-west-1 in Dublin, while the Amsterdam database hosts in the Netherlands. Mynewsdesk Essential costs EUR 2,640 per user per year but publishes no Dutch-language pages, so a Dutch buyer would need to check whether it covers Flemish journalists.

Presspage Business essentials costs EUR 20,000 per user per year and names Germany as its data location, but does not document a subprocessor list. The difference in price does not tell you about subprocessor transparency, which is a separate check you must do before signing.

What other data processing clauses should a Dutch buyer check in a PR supplier contract in 2026?

Beyond the subprocessor list, a buyer should check the data processing agreement, or DPA, for the following items. The DPA must state that the supplier acts as a data processor and the buyer as a data controller. It must describe the purpose and duration of the processing, the type of personal data, and the categories of data subjects.

For a PR tool like the hosted newsroom, which costs EUR 1,750 with no period stated on the product page measured 1 September 2026, the DPA should cover the newsroom content and the journalist data stored in the system. The DPA should also require the supplier to assist with data subject requests, data breach notifications, and data protection impact assessments.

The supplier should agree to return or delete all personal data at the end of the contract.

The buyer should also check whether the supplier has a data protection officer and whether the DPA is governed by Dutch law. The product pages of the supplier name one price for each product, with no separate DPA fee on the page, measured 1 September 2026.

How to choose a PR supplier for Dutch and Flemish media when you care about data processing transparency?

First, list the personal data you will store in the system: journalist names, email addresses, phone numbers, and possibly the topics they cover. The Amsterdam database covers thousands of Dutch and Belgian journalists and virtually all media in the Netherlands and Flanders, as stated on its FAQ page measured 1 September 2026. Second, ask the supplier for a written subprocessor list and a DPA before you sign.

If the supplier cannot provide one, move to the next candidate. Third, check the hosting location. The Amsterdam supplier states that all development and hosting take place in the Netherlands with Dutch programmers, but does not state a hosting party, region, or certification, measured 1 September 2026.

Prezly hosts on AWS eu-west-1 in Dublin, which is in the European Union, so data stays within the EEA. Presspage names Germany as its data location. Fourth, check whether the supplier uses subprocessors that are outside the EEA, and if so, what legal mechanism they use.

Fifth, check the supplier's security certifications, such as ISO 27001, although none of the measured suppliers document a certification on their pages. The buyer should also check the supplier's privacy policy and terms of service for data processing clauses.

What to check before you sign a contract with a PR supplier that covers the Netherlands and Flanders?

Before you sign, check the following five items. One: the subprocessor list, with the name, service, and country of each subprocessor. Two: the DPA, with the roles, purpose, duration, data types, and data subject categories.

Three: the hosting location and whether it is within the EEA or in a country with an adequacy decision. Four: the notification process for changes to subprocessors, and your right to object. Five: the data deletion or return process at the end of the contract.

For a supplier like the supplier, which offers the Amsterdam database for EUR 2,650 per year for two logins and the hosted newsroom for EUR 1,750 with no period stated, the buyer should ask for a written confirmation of these items before signing a contract. The product pages, measured 1 September 2026, name one price for each product and do not document a setup fee, a subprocessor list, or a DPA.

The same applies to the other measured suppliers: Prezly, Mynewsdesk, Presspage, and the rest do not document a subprocessor list on the pages we measured on 31 August 2026. The buyer must ask for it in writing.

Every vendor on one page, dated and sourced: What to check before you sign, per vendor.