Free resource · Reading a DPA
Did you approve a sub-processor by not replying?
Your vendor adds a sub-processor, a company it hands your data to. A clock starts. In some agreements, if you don’t object before it runs out, your silence counts as approval.
Here are the 18 clauses we hold that say so, shortest window first, each quoted with the page it came from.
Download the clausesThe addition is approved because nobody wrote back.
On its own, that’s ordinary drafting: a vendor can’t leave an addition in limbo forever. It becomes a problem when it meets a notice clause that defines notice as updating a published page. Then the clock can run out before anyone has read the page.
5
days, the shortest window in one of these clauses (HiddenLayer)
30
days, the longest (Dataiku)
10
of 18 state no period at all, so the window is set somewhere else in the agreement
Some vendors use the exact same sentence.
Word for word, in different vendors’ agreements.
“If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.”
“If no objection is provided within such period, the Sub-Processor is deemed approved by Customer.”
That’s a template: a starting position, not wording written for you. You can ask to change it.
Every clause, shortest window first.
5dHiddenLayer5 days
“If Subscriber does not provide written objection within such five (5) calendar day period, the Subprocessor shall be deemed approved by Subscriber. - Obligations. HiddenLayer will remain responsible for such Subprocessors compliance with the obligations of this DPA and for any acts or omissions that cause HiddenLayer to breach any of its obligations under this DPA.”
hiddenlayer.com/dpa · read Sep 7, 2026 7dMonday.com7 days
“Where Customer has not objected within such seven (7) day period in the manner described above, the use of the new Sub-Processor shall be deemed accepted by Customer.”
monday.com/l/privacy/dpa/ · read Sep 30, 2026 10dHebbia10 days
“If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.”
hebbia.com/dpa · read Oct 20, 2026 10dLiveKit10 days
“If no objection has been raised within the ten (10) day period mentioned in Section 6.2, LiveKit will deem Customer to have authorized the new Sub-processor. 7.”
livekit.io/legal/data-processing-addendum · read Nov 2, 2026 10dMistral AI10 days
“The Customer may only object in writing to Mistral AI’s appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to [email address on the vendor's page], provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.”
legal.mistral.ai/terms/data-processing-addendum · read Oct 10, 2026 10dWiz10 days
“Failure to object to such Sub-Processor in writing within ten (10) days following Wiz's notice shall be deemed as acceptance of the Sub-Processor.”
wiz.io/data-processing-agreement · read Oct 23, 2026 15dCognition15 days
“If Customer does not object within fifteen (15) days of receiving notice, Customer shall be deemed to have accepted the updated Subprocessor list.”
cognition.ai/dpa · read Oct 27, 2026 30dDataiku30 days
“If Customer does not object within the said period of thirty (30) days, Customer is deemed to have accepted the new Subprocessor.”
dataiku.com/legal/data-processing-addendum · read Oct 31, 2026 —AssemblyAIWindow not stated in the clause · same wording as Braintrust, Poolside
“If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.”
assemblyai.com/legal/data-processing-addendum · read Oct 29, 2026 —BasetenWindow not stated in the clause
“If Customer does not object to Baseten’s appointment of a Sub-Processor during the objection period referred to in Section 6.4, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. DATA SUBJECT RIGHTS Baseten, taking into account the nature of the Processing of Customer Personal Data, shall provide Customer with such assistance as may be reason…”
www.baseten.co/terms-and-conditions/ · read Sep 11, 2026 —BraintrustWindow not stated in the clause · same wording as AssemblyAI, Poolside
“If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.”
braintrust.dev/legal/dpa · read Oct 8, 2026 —ClariWindow not stated in the clause · same wording as Salesloft
“If no objection is provided within such period, the Sub-Processor is deemed approved by Customer.”
clari.com/dpa · read Sep 9, 2026 —Fireflies.aiWindow not stated in the clause
“If Customer does not object to Fireflies.ai's appointment of a Subprocessor during the objection period, Customer shall be deemed to have approved the engagement and ongoing use of that Subprocessor.”
fireflies.ai/data-processing-agreement · read Sep 30, 2026 —LangChainWindow not stated in the clause
“If Customer does not timely object to a new Subprocessor, the Subprocessor is deemed accepted.”
langchain.com/dpa · read Sep 30, 2026 —LogicMonitorWindow not stated in the clause
“If the Customer does not so object, the engagement of the New Sub-processor shall be deemed accepted by the Customer. - **8.4.”
logicmonitor.com/legal/data-processing-addendum · read Oct 29, 2026 —PoolsideWindow not stated in the clause · same wording as AssemblyAI, Braintrust
“If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.”
poolside.ai/legal/dpa · read Oct 10, 2026 —SalesloftWindow not stated in the clause · same wording as Clari
“If no objection is provided within such period, the Sub-Processor is deemed approved by Customer.”
salesloft.com/legal/data-processing-addendum · read Oct 23, 2026 —WorkatoWindow not stated in the clause
“If Account Holder does not object to the proposed Sub-Processor within the period above, the new Sub-Processor will be deemed an Authorized Sub-Processor for the purposes of this DPA.”
workato.com/legal/dpa · read Oct 23, 2026
Clauses with a different limit.
These don’t say what silence means. They limit the reasons you’re allowed to object for, which is a different term.
“If Customer does not terminate the Agreement within this 30 day period, Customer will be deemed to have accepted the new Sub-Processor, or should cease using the Services for which NVIDIA has engaged the Sub-Processor. 6.4 SUB-PROCESSOR OBLIGATIONS.”
www.nvidia.com/en-us/agreements/data-processing-addendum/nvidia-cloud-services-data-processing-addendum/ · read Nov 1, 2026
What to ask for at renewal.
Three changes to ask for.
- 1
Notice that arrives.
An email to a named address, not a page that changes.
- 2
A window that starts on delivery.
It runs from when you receive the notice, not when it's published, so a notice you never got can't use it up.
- 3
An outcome other than approval.
The right to end the affected service without penalty, if you object and the vendor goes ahead anyway.
If your vendor’s clause is one of the shared sentences above, say so. It’s a template, and a template is where a negotiation starts.
Take every clause into your next renewal.
All of them as a Word document, with windows, sources and read dates. It’s current on the day you download it.
Common questions.
What is a silence-as-consent clause?
A term stating that if you do not object to a new sub-processor within a set period, it is treated as approved. It turns inaction into agreement, and the period usually runs from the vendor's notice rather than from the day you read it.
Is silence as consent normal in a DPA?
On its own it is ordinary drafting: a vendor cannot leave an addition unresolved forever. It becomes a problem when the same agreement defines notice as updating a published page, because then the clock can run out before anyone has read the page.
How long do I have to object to a new sub-processor?
It depends on the agreement, and the range is wide. In the clauses collected here the shortest stated period is 5 days (HiddenLayer) and the longest is 30 (Dataiku), and 10 state the consequence without naming a period at all.
Can I refuse a new sub-processor?
Check what your agreement says happens after you object. If the answer is a right to end the affected service, an objection ends in an exit, not a block.
What should I ask for instead?
Notice that arrives at a named address, a window that runs from delivery rather than publication, and an outcome other than deemed approval, such as a right to end the affected service.
Read a DPA
More for this job.
- DatasetWindows, by vendorEach vendor's window to object or notice period, quoted from its own DPA.Open it ›
- ExplainerWhat a notice clause obliges you to doWhy the clock starts at their notice, not the day you find out.Open it ›
- ComparisonDo AI providers train on your data?OpenAI, Anthropic, Google and Microsoft on training and retention, side by side.Open it ›
- ComparisonAWS, Google Cloud and Microsoft sub-processor termsHow much notice each cloud gives before it adds a sub-processor.Open it ›
- ComparisonAI model providers' sub-processor termsOpenAI, Anthropic, Google Cloud, Mistral, xAI and Groq: each one's notice period and how it's sent.Open it ›
- ExplainerWhat is a DPA?What the law says a data processing agreement has to contain.Open it ›
- ExplainerWhat are SCCs?The EU's approved transfer terms, and the sub-processor period vendors fill in.Open it ›
- ChecklistDPA red-flag checklistSix DPA terms that decide whether a change reaches your customers before you do.Open it ›
- TemplateAI addendum clause bankTerms to ask for in a DPA, each with a smaller fallback if refused.Open it ›
- TemplateSub-processor objection letterA short, polite letter that quotes your vendor's own clause back to them.Open it ›
Each clause is quoted from an agreement the vendor publishes, with its URL and the date we read it. The window shown is the one named inside the quoted clause. Where the clause names none, the row says so.
Shared wording means the clauses’ first sentences match once party names are set aside. It is a fact about two documents, not a claim about the companies. How we keep the record.
This is not legal advice. The agreements quoted are published documents read on the dates shown. Your negotiated contract governs, and a public template may not be the one you signed. The record is free to read, and corrections are free to request.