Free resource · Reading a DPA
What to send back when a vendor’s contract puts the work on you.
Some terms in an AI vendor’s data processing agreement (DPA) leave you watching a web page, objecting against a short clock, or unable to prove what the page said.
Here are 7 of them, each with the language to ask for, a smaller version if that’s refused, and, where we hold one, a real published clause it fixes.
Download the clause bankAsk for the fallback too.
Each entry has a smaller version under the main ask, so you have somewhere to go if the first answer is no.
Your counsel writes the final wording.
A lawyer didn’t draft this. Each ask is a plain-language statement of what to request, in the shape a redline takes.
Naming a vendor isn’t a complaint.
Every term here is ordinary drafting a competent counsel wrote on purpose. We only show that a published agreement contains it, and language that doesn’t.
The 7 terms, and what to ask for.
- 01
Silence counts as agreement
Not replying inside a window you may never have seen approves the sub-processor for you.
Ask for
If Customer objects to a new Sub-processor within the Objection Period, Supplier shall not use that Sub-processor to process Customer Personal Data unless and until the objection is withdrawn. Customer's failure to respond within the Objection Period shall not constitute approval.
If that’s refused
If Customer objects within the Objection Period and the parties do not resolve the objection within thirty (30) days, Customer may terminate the affected Services on written notice, without penalty and with a pro-rata refund of pre-paid fees.
Published clauses this fixes · 10
Monday.com “Where Customer has not objected within such seven (7) day period in the manner described above, the use of the new Sub-Processor shall be deemed accepted by Customer.”
monday.com/l/privacy/dpa/ · read Sep 30, 2026
Hebbia “If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.”
hebbia.com/dpa · read Oct 20, 2026
LiveKit “If no objection has been raised within the ten (10) day period mentioned in Section 6.2, LiveKit will deem Customer to have authorized the new Sub-processor.”
livekit.io/legal/data-processing-addendum · read Nov 2, 2026
And 7 more.
- 02
Notice means the page changed
Notice is defined as updating a page, so the window runs whether or not anyone has read it.
Ask for
Supplier shall give notice of any intended addition or replacement of a Sub-processor by email to the addresses Customer designates in writing, at least thirty (30) days before the Sub-processor begins processing Customer Personal Data. Publication on a website shall not by itself constitute notice.
If that’s refused
Supplier shall maintain a subscription mechanism for Sub-processor changes and shall enroll the addresses Customer designates on execution of this Agreement, without requiring further action by Customer.
Published clauses this fixes · 12
RunPod “Within ten (10) business days of an update to the list of Sub-Processors, Customer shall inform Runpod, in writing, of objections to any new Sub-Processors, if any.”
www.runpod.io/legal/data-processing-agreement · read Oct 29, 2026
Demandbase “Customer may object in writing to Demandbase’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Demandbase promptly in writing within five (5) calendar days of an update to the Sub-processor List referenced in Section 3.3 and the parties shall discuss Customer concerns in good faith with a view to achieving a commercially reasonable resolution.”
demandbase.com/data-processing-agreement · read Oct 24, 2026
LangChain “Customer may only object to the addition of a Subprocessor within seven days of LangChain’s update based on reasonable grounds relating to a Subprocessor’s ability to protect Personal Data in accordance with Data Protection Law by providing written notice detailing the grounds of such objection.”
langchain.com/dpa · read Sep 30, 2026
And 9 more.
- 03
Notice only if you subscribed first
The notice exists but only reaches you if someone found and completed a sign-up form first.
Ask for
Supplier shall enroll the notification addresses designated by Customer in Schedule [X] on the Effective Date, and shall not require Customer to subscribe, register or opt in as a condition of receiving Sub-processor notices.
If that’s refused
Supplier shall confirm in writing within ten (10) days of the Effective Date that Customer's designated addresses are receiving Sub-processor notifications.
Published clauses this fixes · 7
AssemblyAI “At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein. Customer may object to such an engagement by informing AssemblyAI within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
assemblyai.com/legal/data-processing-addendum · read Oct 29, 2026
Poolside “At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and provide a mechanism for Customer to receive notice of that update. Customer may object to such an engagement by informing Company within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
poolside.ai/legal/dpa · read Oct 10, 2026
Adobe “Adobe will provide such notification to those email addresses that have subscribed at least fourteen (14) days in advance of allowing the new Sub-processor to Process Personal Data (the “Objection Period”).”
www.adobe.com/content/dam/cc/en/legal/terms/enterprise/pdfs/DPA-WW.pdf · read Oct 1, 2026
And 4 more.
- 04
You may object only on stated grounds
The clause limits which reasons count, and the vendor decides whether yours does.
Ask for
Customer may object to a new Sub-processor on any ground relating to the protection of Personal Data, including Customer's own obligations to its customers. Supplier shall not require Customer to demonstrate that a ground is reasonable as a condition of the objection being recorded.
If that’s refused
Where Supplier disputes that an objection is made on reasonable data protection grounds, Supplier shall set out its reasons in writing within ten (10) days, and the Objection Period shall be suspended until it does so.
Published clauses this fixes · 31
Airtable “Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.”
airtable.com/dpa · read Oct 22, 2026
Lovable “In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting [email address on the vendor's page].”
lovable.dev/data-processing-agreement · read Oct 30, 2026
Anyscale “(d) Customer may object in writing to Anyscale's appointment of a new Subprocessor based on reasonable data protection concerns by emailing [email address on the vendor's page] within five (5) calendar days of notice of a new Subprocessor from Anyscale and the parties will discuss such concerns in good faith.”
anyscale.com/dpa · read Oct 3, 2026
And 28 more.
- 05
Objecting starts a conversation, not a veto
Objecting obliges the vendor to talk to you and to nothing else.
Ask for
If the parties do not resolve an objection within thirty (30) days of Supplier's receipt of it, Customer may terminate the affected Services on written notice, without penalty and with a pro-rata refund of pre-paid fees covering the terminated period.
If that’s refused
Supplier shall respond substantively to an objection within ten (10) days and shall state what alternatives, if any, are available to Customer.
Published clauses this fixes · 6
Anyscale “(d) Customer may object in writing to Anyscale's appointment of a new Subprocessor based on reasonable data protection concerns by emailing [email address on the vendor's page] within five (5) calendar days of notice of a new Subprocessor from Anyscale and the parties will discuss such concerns in good faith.”
anyscale.com/dpa · read Oct 3, 2026
Demandbase “Customer may object in writing to Demandbase’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Demandbase promptly in writing within five (5) calendar days of an update to the Sub-processor List referenced in Section 3.3 and the parties shall discuss Customer concerns in good faith with a view to achieving a commercially reasonable resolution.”
demandbase.com/data-processing-agreement · read Oct 24, 2026
Vercel “If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.”
vercel.com/legal/dpa · read Oct 28, 2026
And 3 more.
- 06
The window is in business days
A window in business days is shorter than it reads, and the public holidays it skips are the vendor's.
Ask for
All periods in this Section are calendar days and run from Customer's receipt of notice.
If that’s refused
Where a period would expire on a day that is not a business day in Customer's principal place of business, it shall expire on the next business day.
Published clauses this fixes · 8
Airtable “Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.”
airtable.com/dpa · read Oct 22, 2026
Algolia “Subscriber may object to Algolia's use of a new Sub-processor by notifying Algolia promptly in writing within ten (10) business days after receipt of Algolia's notice.”
www.algolia.com/policies/data-processing-addendum · read Oct 30, 2026
DataRobot “Customer may object to DataRobot’s use of a new Subprocessor by notifying DataRobot in writing within ten (10) business days after notice of an updated Subprocessor List.”
datarobot.com/legal/dpa · read Sep 11, 2026
And 5 more.
- 07
You can prove what the page said
When a dispute arrives you need the version of the page that was live on the day, and by then the vendor has replaced it.
Ask for
Supplier shall retain, for the term and for two (2) years afterwards, a dated copy of each version of its published Sub-processor list and Data Processing Agreement, and shall provide any such version to Customer within ten (10) days of a written request. Supplier shall not treat the current version of a published document as evidence of its content at an earlier date.
If that’s refused
Supplier acknowledges that Customer may retain dated copies of Supplier's published documents, including through a third-party monitoring service, and shall not treat such retention as a breach of any confidentiality or acceptable-use term.
None of the notice clauses we quote from 81 vendors mentions a dated copy of what a page said.
How to use it in a redline.
Pick two or three.
A markup touching every clause in a sub-processor section reads as a rewrite. Two changes with a stated reason are easier to say yes to.
Start with these two.
Notice that actually arrives, and an outcome other than deemed approval.
Quote their own clause.
If their sentence appears word for word in other vendors’ agreements, say so politely: it’s a template, not wording written for you.
Take the clause bank into your next renewal.
Every entry as a Word document, with the paired clauses and their sources, ready to lift into a redline. It’s current on the day you download it.
Common questions.
What should I negotiate in an AI vendor DPA?
Two things first: notice that arrives at an address you name rather than a page that changes, and an outcome other than deemed approval if you object.
Can I get a vendor to remove a silence-as-consent clause?
You can ask. If the answer is no, the fallback under that entry is smaller: a right to end the affected service if your objection isn't resolved.
What is a window to object?
How long you have to object to a new sub-processor (a company your vendor hands your data to) before it counts as approved. The clauses we quote run from 5 calendar days to 30, counted from the vendor's notice, not from when you read it.
Should I ask for evidence rights in a DPA?
None of the notice clauses we quote mentions them. A right to a dated copy of what a published page said is what makes a later dispute about timing answerable rather than a matter of recollection.
How many clauses should I mark up?
Two or three. A markup touching every clause in a sub-processor section reads as a rewrite; two changes with a stated reason are easier to say yes to.
Read a DPA
More for this job.
- DatasetWindows, by vendorEach vendor's window to object or notice period, quoted from its own DPA.Open it ›
- ExplainerWhat a notice clause obliges you to doWhy the clock starts at their notice, not the day you find out.Open it ›
- ComparisonDo AI providers train on your data?OpenAI, Anthropic, Google and Microsoft on training and retention, side by side.Open it ›
- ComparisonAWS, Google Cloud and Microsoft sub-processor termsHow much notice each cloud gives before it adds a sub-processor.Open it ›
- ComparisonAI model providers' sub-processor termsOpenAI, Anthropic, Google Cloud, Mistral, xAI and Groq: each one's notice period and how it's sent.Open it ›
- ExplainerWhat is a DPA?What the law says a data processing agreement has to contain.Open it ›
- ExplainerWhat are SCCs?The EU's approved transfer terms, and the sub-processor period vendors fill in.Open it ›
- ChecklistDPA red-flag checklistSix DPA terms that decide whether a change reaches your customers before you do.Open it ›
- TemplateSub-processor objection letterA short, polite letter that quotes your vendor's own clause back to them.Open it ›
- DatasetSilence as consentThe agreements where not objecting in time counts as approving the sub-processor.Open it ›
The model language is ours. The paired clauses are quoted from agreements vendors publish, found by the same detector behind the red-flag checklist, with each URL and the date we read it. A clause we can’t show cleanly is left out, never paraphrased.
This is not legal advice, and counsel hasn’t settled the model language for your situation. The agreements quoted are published documents read on the dates shown, and your negotiated contract may differ from the public template.
Naming an agreement is not an allegation about the vendor. The record is free to read, and corrections are free to request.