Free resource · Reading a DPA
Could a vendor change blindside you? Six terms decide.
Your data processing agreement (DPA) with each AI vendor lets it add sub-processors: companies your vendor hands your data to. It also decides how you find out, and how long you have to object.
Here are the six terms that do most of that work. Each one is quoted from an agreement a vendor publishes, with what to ask for at renewal.
Download the checklistA term on this list isn’t a mark against the vendor.
Each is ordinary drafting a competent counsel wrote on purpose, and most are reasonable positions for a vendor to hold. The checklist says only that the term moves work or risk onto you.
We report what a page says, never what it means about the company that published it. How we keep the record.
The six terms, and what to ask for instead.
Read across the sub-processor notice clauses we quote from 81 vendors.
- 01
Silence counts as agreement
What it costs you
A window you miss is not a decision deferred. The sub-processor is approved, and you approved it by not reading a page.
Ask for instead
Approval requires an affirmative response, or the window pauses until the vendor confirms you received notice.
Found in 10 of 81 vendors’ clauses. See one.
Monday.com “Where Customer has not objected within such seven (7) day period in the manner described above, the use of the new Sub-Processor shall be deemed accepted by Customer.”
monday.com/l/privacy/dpa/ · read Sep 30, 2026
Also in HiddenLayer, Hebbia, LiveKit, Mistral AI, Wiz, Anthropic, Cognition, Smartsheet, Dataiku.
- 02
Notice means the page changed
What it costs you
The clock starts when the page is edited, so the only way to be inside the window is to have been reading the page.
Ask for instead
Notice is delivered to a named address, and the window to object runs from receipt rather than from publication.
Found in 12 of 81 vendors’ clauses. See one.
RunPod “Within ten (10) business days of an update to the list of Sub-Processors, Customer shall inform Runpod, in writing, of objections to any new Sub-Processors, if any.”
www.runpod.io/legal/data-processing-agreement · read Oct 29, 2026
Also in Demandbase, LangChain, Vespa, CoreWeave, ElevenLabs, GitHub, Hugging Face, MongoDB, PagerDuty, Snyk, Zendesk.
- 03
Notice only if you subscribed first
What it costs you
The obligation to tell you is conditional on an action someone at your company took once. When that person leaves, the notice goes to a mailbox nobody reads.
Ask for instead
Notice goes to a role address you nominate in the agreement, independent of any mailing list.
Found in 7 of 81 vendors’ clauses. See one.
AssemblyAI “At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein. Customer may object to such an engagement by informing AssemblyAI within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
assemblyai.com/legal/data-processing-addendum · read Oct 29, 2026
Also in Poolside, Adobe, Amazon Web Services, Atlassian, Cisco, Splunk.
- 04
You may object only on stated grounds
What it costs you
Commercial discomfort is not a ground. The objection has to rest on data-protection reasoning and be written down, which takes preparation you will not have inside a short window.
Ask for instead
Grounds broad enough to cover your own customers' contractual objections, not only your regulator's.
Found in 31 of 81 vendors’ clauses. See one.
Airtable “Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.”
airtable.com/dpa · read Oct 22, 2026
Also in Gong, Lovable, Anyscale, Demandbase, Vercel, LangChain, AssemblyAI, Baseten, Braintrust, Databricks, Mistral AI, Poolside, Toloka, Vespa, Workato, Zapier, Datadog, Eightfold AI, Fiddler AI, Groq, Harvey, xAI, Intercom, Asana, Automation Anywhere, HubSpot, Hugging Face, Lucidworks, Sema4.ai, Zscaler.
- 05
Objecting starts a conversation, not a veto
What it costs you
You can object, and the vendor can proceed. What the clause guarantees is good-faith discussion, which is worth having and is not the same as a right to refuse.
Ask for instead
A stated outcome where the concern is not resolved: suspension of the sub-processor for your data, or termination without penalty.
Found in 6 of 81 vendors’ clauses. See one.
Anyscale “(d) Customer may object in writing to Anyscale's appointment of a new Subprocessor based on reasonable data protection concerns by emailing [email address on the vendor's page] within five (5) calendar days of notice of a new Subprocessor from Anyscale and the parties will discuss such concerns in good faith.”
anyscale.com/dpa · read Oct 3, 2026
Also in Demandbase, Vercel, Fiddler AI, Intercom, Hugging Face.
- 06
The window is in business days
What it costs you
Business days read as a longer period than they are. A tracker that stores the number and drops the unit computes the wrong date, and the error always runs against you.
Ask for instead
Calendar days, so the deadline is arithmetic rather than a public-holiday calendar.
Found in 8 of 81 vendors’ clauses. See one.
Airtable “Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.”
airtable.com/dpa · read Oct 22, 2026
Also in Gong, Algolia, DataRobot, Insider, New Relic, RunPod, Lovable.
And one more thing to check
How long the window to object is.
39
of the 55 windows to object we quote are shorter than 30 days
The clock starts at their notice.
Put a short window together with notice by publication, and the deadline can pass before anyone at your company has looked at the page.
Every window we can quote, shortest first.
Check your own agreements against it.
The same six terms as a Word document you can work through, with the quotes, sources and read dates. It’s current on the day you download it.
Common questions.
What is a sub-processor notice clause?
The term in a data processing agreement that lets a vendor add a new sub-processor, sets how it will tell you, and gives you a fixed period to object. The period usually runs from the vendor's notice rather than from the day you find out.
What does silence-as-consent mean in a DPA?
A clause stating that if you do not object within the stated period, the new sub-processor is treated as approved. Miss the window and you have approved it, by not reading a page.
Is a 30-day window to object standard?
Thirty days is the most common figure in the clauses we quote, but not a majority of them. Shorter windows are frequent, and the shortest window to object we can quote is 5 calendar days.
Does my vendor have to email me when it adds a sub-processor?
It depends on the clause. Some agreements define notice as updating a published page, so the update itself is the notice. Others promise an email, and some send one only to addresses that subscribed to a notification list first.
Read a DPA
More for this job.
- DatasetWindows, by vendorEach vendor's window to object or notice period, quoted from its own DPA.Open it ›
- ExplainerWhat a notice clause obliges you to doWhy the clock starts at their notice, not the day you find out.Open it ›
- ComparisonDo AI providers train on your data?OpenAI, Anthropic, Google and Microsoft on training and retention, side by side.Open it ›
- ComparisonAWS, Google Cloud and Microsoft sub-processor termsHow much notice each cloud gives before it adds a sub-processor.Open it ›
- ComparisonAI model providers' sub-processor termsOpenAI, Anthropic, Google Cloud, Mistral, xAI and Groq: each one's notice period and how it's sent.Open it ›
- ExplainerWhat is a DPA?What the law says a data processing agreement has to contain.Open it ›
- ExplainerWhat are SCCs?The EU's approved transfer terms, and the sub-processor period vendors fill in.Open it ›
- TemplateAI addendum clause bankTerms to ask for in a DPA, each with a smaller fallback if refused.Open it ›
- TemplateSub-processor objection letterA short, polite letter that quotes your vendor's own clause back to them.Open it ›
- DatasetSilence as consentThe agreements where not objecting in time counts as approving the sub-processor.Open it ›
This is not legal advice. The agreements quoted are published documents read on the dates shown; your negotiated contract governs over anything here. The record is free to read, and corrections are free to request.