Resource · Reading a DPA
Six DPA terms that decide whether a vendor change can blindside you
Your data processing agreement lets each AI vendor add sub-processors. It also decides how you find out and how long you have to say anything. Six terms do most of that work, and each one below was found in an agreement a vendor publishes — quoted, with the page and the date we read it.
Read from 36 sub-processor notice clauses currently in the record. Everything in the downloadable checklist is on this page.
A term on this list is not a mark against the vendor
Every one of these is ordinary drafting that a competent counsel wrote deliberately, and most of them are reasonable positions for a vendor to hold. What the checklist says is narrower: this term moves work or risk onto you, here is a published agreement that contains it, and here is the language to ask for at renewal.
We report what a page says, never what it means about the company that published it. How the record is kept.
Silence counts as agreement
What it costs you. A window you miss is not a decision deferred. The sub-processor is approved, and you approved it by not reading a page.
Ask for instead. Approval requires an affirmative response, or the window pauses until the vendor confirms you received notice.
Found in 2 of 36 agreements. One of them:
The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.
Mistral AI — https://legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026
Also in Cognition.
Notice means the page changed
What it costs you. Nothing arrives. No email is owed and none is sent. The clock starts when the page is edited, so the only way to be inside the window is to have been reading the page.
Ask for instead. Notice is delivered to a named address, and the objection period runs from receipt rather than from publication.
Found in 1 of 36 agreements. One of them:
At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List.
Vespa — https://vespa.ai/data-processing-agreement · read Aug 31, 2026
Notice only if you subscribed first
What it costs you. The obligation to tell you is conditional on an action someone at your company took once. When that person leaves, the notice goes to a mailbox nobody reads.
Ask for instead. Notice goes to a role address you nominate in the agreement, independent of any mailing list.
Found in 4 of 36 agreements. One of them:
(c) Anyscale shall notify Customer if it engages a new Subprocessor at least ten (10) days prior to any such change if Customer opts-in to receive such notifications in the manner made available on the Subprocessor List.
Anyscale — https://anyscale.com/dpa · read Aug 31, 2026
Also in AssemblyAI, Poolside, Harvey.
You may object only on stated grounds
What it costs you. Commercial discomfort is not a ground. The objection has to rest on data-protection reasoning and be written down, which takes preparation you will not have inside a short window.
Ask for instead. Grounds broad enough to cover your own customers' contractual objections, not only your regulator's.
Found in 7 of 36 agreements. One of them:
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …
Gong — https://gong.io/legal/data-processing-addendum · read Aug 31, 2026
Also in Lovable, Vercel, Mistral AI, Baseten, xAI, Lucidworks.
Objecting starts a conversation, not a veto
What it costs you. You can object, and the vendor can proceed. What the clause guarantees is good-faith discussion, which is worth having and is not the same as a right to refuse.
Ask for instead. A stated outcome where the concern is not resolved: suspension of the sub-processor for your data, or termination without penalty.
Found in 1 of 36 agreements. One of them:
If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.
Vercel — https://vercel.com/legal/dpa · read Aug 31, 2026
The window is in business days
What it costs you. Business days read as a longer period than they are. A tracker that stores the number and drops the unit computes the wrong date, and the error always runs against you.
Ask for instead. Calendar days, so the deadline is arithmetic rather than a holiday calendar.
Found in 3 of 36 agreements. One of them:
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …
Gong — https://gong.io/legal/data-processing-addendum · read Aug 31, 2026
Also in Airtable, Lovable.
And the seventh thing to check: the window itself
22 of the 36 agreements in the record state an objection period shorter than 30days. The period runs from the vendor’s notice, so a short window and a publication-only notice clause combine into a deadline that can pass before anyone at your company has looked at the page.
Every window we can quote is listed, shortest first.
Take it with you
The same six terms as a Word document you can work through against your own agreements, with the quotes, sources and read dates included. It is generated when you download it, so it carries the record as it stands that day.
Common questions
- What is a sub-processor notice clause?
- The term in a data processing agreement that lets a vendor add a new sub-processor, sets how it will tell you, and gives you a fixed period to object. The period usually runs from the vendor's notice rather than from the day you find out.
- What does silence-as-consent mean in a DPA?
- A clause stating that if you do not object within the stated period, the new sub-processor is treated as approved. A missed window is not a decision deferred; it is an approval you gave by not reading a page.
- Is a 30-day objection window standard?
- It is the most common figure in the agreements we hold, but not a majority of them. Shorter windows are frequent, and the shortest we can quote is five business days.
- Does my vendor have to email me when it adds a sub-processor?
- It depends on the clause. Some agreements define notice as updating a published page, in which case nothing arrives. Others send an email, and some send one only to addresses that subscribed to a notification list first.
Reading a DPA
Understand what your agreement actually obliges you to do.
- Sub-processor notice windows, by vendor
The objection window each vendor's own DPA states, quoted with its source and read date.
- What a sub-processor notice clause obliges you to do
The period runs from their notice, not from your discovery. What that means, quoted from the agreements.
- AI addendum clause bank
Seven terms to ask for, each with the smaller version that tends to be granted — paired with the published clauses they fix.
- Sub-processor objection letter
A letter that quotes the vendor's own clause back at them — with all 36 clauses to paste in, and the three that say where to send it.
- Silence as consent
13 agreements where not objecting approves the sub-processor — windows from five days to thirty, and several word-for-word identical.
This is not legal advice. The agreements quoted are published documents read on the dates shown; your negotiated contract governs over anything here. The record behind this page is free to read, and corrections are free to request.