The white-label and outsourced delivery market

What is changing in outsourced delivery?

White-label delivery depends on the buyer contracting with the agency and having no reason to ask who does the work. Three EU instruments give certain buyers a reason to ask, because each makes the buyer answerable for what its supplier does with the work. The GDPR requires a controller to use only processors able to show they will meet its requirements; DORA keeps a financial entity fully responsible for its obligations when it uses ICT services; and NIS2 requires entities in scope to manage supply chain security in their relationships with direct suppliers and service providers. (Sources: Regulation (EU) 2016/679 (GDPR), Article 28(1), as of 20 October 2026; Regulation (EU) 2022/2554 (DORA), Article 28(1)(a), as of 20 October 2026; Directive (EU) 2022/2555 (NIS2), Article 21(1) and (2)(d), as of 20 October 2026.)

Each applies within its own scope: the GDPR where an agency processes personal data on a client's behalf, NIS2 where the client is an essential or important entity in a sector it lists, and DORA where the client is a financial entity and the agency provides it with ICT services. NIS2 is a directive that Member States apply through national law, with national measures due to apply from 18 October 2024, and DORA has applied since 17 January 2025. Exhibit 1 sets the three beside each other. (Sources: Directive (EU) 2022/2555 (NIS2), Articles 21(1) and 41, as of 20 October 2026; Regulation (EU) 2022/2554 (DORA), Article 64, as of 20 October 2026.)

How far does the financial rule go?

DORA goes furthest. The Commission's delegated regulation specifies what a financial entity must assess when a provider subcontracts a service supporting a critical or important function. The provider must be able to identify every such subcontractor, tell the financial entity who they are, and give it the information needed to assess them. The contract with each subcontractor must give the financial entity and its authorities the same rights of access and inspection as the provider's own contract, and the financial entity may provide for termination where a provider subcontracts a service the contract did not permit to be subcontracted. (Source: Commission Delegated Regulation (EU) 2025/532, Articles 3(1), 4(1) and 6, as of 20 October 2026.)

The regulation also treats the length and complexity of the chain, the location of subcontractors and whether the service is concentrated in one subcontractor as factors the financial entity must weigh. Its Article 3(3) says that relying on a provider's own assessment of its subcontractors does not reduce the financial entity's final responsibility. (Source: Commission Delegated Regulation (EU) 2025/532, Articles 1 and 3(3), as of 20 October 2026.)

Could the agency itself be in scope?

Possibly, and the question runs both ways. NIS2 defines a managed service provider as an entity providing services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure or applications, whether on customers' premises or remotely, and its Annex I lists managed service providers as a sector under ICT service management between businesses. Whether a particular agency falls within NIS2 depends on scope rules in the directive that we did not read, and on national law. (Sources: Directive (EU) 2022/2555 (NIS2), Article 6(39) and Annex I, as of 20 October 2026.)

Under DORA an undertaking providing ICT services is an ICT third-party service provider, so an agency that sells such services to a financial entity is the supplier whose subcontracting the financial entity must assess. (Source: Regulation (EU) 2022/2554 (DORA), Article 3(19), as of 20 October 2026.)

What does this mean for an agency that uses partners?

Our reading is that three things follow, each about being ready to answer a question. The agency can say, for any engagement, who does the work, where and under what contract, because DORA contracts must state locations and conditions of subcontracting. It can obtain the client's authorization before a partner touches personal data, and tell the client of changes, because that is what Article 28(2) of the GDPR sets up. And it can show that the duties that bind it are written into the agreement with the partner, because Article 28(4) of the GDPR requires the same data protection duties to pass down by contract. Exhibit 2 shows the chain. (Sources: Regulation (EU) 2022/2554 (DORA), Article 30(2)(a) and (b), as of 20 October 2026; Regulation (EU) 2016/679 (GDPR), Article 28(2) and (4), as of 20 October 2026.)

None of this forbids white-label delivery. It makes delivery that is hidden from a client who has a legal duty to see it hard to defend. The line, in the work, is the written scope: whether it names the arrangement, and whether the client has agreed to it. Under DORA that agreement, and notice of change, are built into the contract for services that support critical or important functions. (Sources: Commission Delegated Regulation (EU) 2025/532, Articles 4 and 5, as of 20 October 2026; Regulation (EU) 2016/679 (GDPR), Article 28(2), as of 20 October 2026.)

What is not changing?

Work outside these scopes is untouched by these three texts. A client with no personal data in the work, not in a sector NIS2 lists and not a financial entity has no duty under them to ask about the agency's partners, and what the parties tell each other is a matter of their agreement. This briefing does not measure the size or shape of the outsourcing market, because no source read for it gives that, and it does not describe the rules of other countries. The Parliament's tracker shows proposals that would amend the GDPR and NIS2 as still pending in its information of 20 September 2026; the passages read here are not among the changes the tracker lists. (Sources: European Parliament Legislative Train, Digital Omnibus and Targeted amendments to the NIS2 Directive, updated 20 September 2026, as of 20 October 2026.)