During due diligence, a customer learns that a prospective cloud provider uses subprocessors in several other countries for customer support and backup storage. The standard contract does not name them or their locations. What should the customer do to evaluate this legal risk?

Cloud-specific legal risk often hides in the supply chain. Each subprocessor that stores, backs up or accesses customer data introduces its own jurisdiction, legal access regime and security posture, so the customer cannot evaluate exposure without knowing who those parties are and where they operate. Sound practice is to require a list of subprocessors and locations, contractual flow-down of the same security, privacy and confidentiality obligations, advance notice of changes with a right to object or exit, and audit or assurance coverage. Assuming the primary provider's certification covers subcontractors is unsafe; certifications have defined scopes, and subservice organizations are often carved out. Treating backups and support access as outside data processing is wrong; storing copies and viewing records are processing, and remote access from another country can itself be a cross-border transfer under privacy laws. Encrypting data in transit protects confidentiality on the network but does nothing about data at rest in another country or the legal obligations of a foreign subprocessor that can be compelled to assist. Exam caveat: privacy regimes such as the GDPR explicitly require processor contracts to address subprocessors. Operational check: confirm the contract contains a subprocessor list, flow-down clause, change notification period and termination right.