How do I object to a new sub-processor?

In writing, within the window your data processing agreement states, on grounds that relate to data protection. Quote the clause you rely on, so the vendor doesn't have to check you have the right.

Where do I send a sub-processor objection?

To the notice address your vendor's DPA names. If the DPA names none, use the privacy contact on the vendor's privacy page, and copy your account manager.

What are reasonable grounds to object to a sub-processor?

Grounds about data protection, not preference: processing in a country your own customer commitments exclude, processing outside the current scope, or customer agreements that need a consent you don't hold.

Can I block a vendor from adding a sub-processor?

Not under the clauses we quote: they give you a right to object, not a veto. Check whether your agreement gives a right to end the affected service if the objection isn't resolved.

How long do I have to object?

The clauses we've quoted run from 5 days to 30 days. The window starts at the vendor's notice, not the day you read it, so part of it may already be spent.

Free template · Sub-processor objection letter

Your vendor added a sub-processor. Want to object?

A sub-processor is a company your vendor hands your data to. Your data processing agreement (DPA) may give you a set number of days to object, counted from the vendor’s notice.

Here's a short, polite letter that quotes your vendor's own clause back to them.

You don’t have long.

The clock starts at the vendor’s notice, not the day you read it.

5 days

The shortest window to object in the clauses we've quoted.

30 days

The longest.

Vendor clauses quoted below, ready to paste into the letter.

Here’s the letter.

One page. Fill in the highlighted blanks and send it.

[Date]

To: [vendor notices address]

cc: [your account manager]

Subject: Objection to new sub-processor — [vendor name], notice dated [date of notice]

We are writing under [clause reference] of the data processing agreement between [your company] and [vendor name] to object to the appointment of [new sub-processor name], notified on [date of notice].

That clause provides:

[paste the vendor's clause here, exactly as published]

Our objection is made on the following grounds, which relate to data protection:

[state the grounds — for example, that the sub-processor processes in a jurisdiction your own customer commitments exclude, that it introduces a category of processing outside the current scope, or that your own customers' agreements require their consent, which you do not hold]

We ask that you confirm within [10] days:

1. that this objection has been received and recorded within the period the clause allows;

2. whether [vendor name] will refrain from using [new sub-processor name] for our data, and if so on what terms;

3. if it will not, the options available to us under the agreement, including any right to terminate the affected service without penalty and any refund of pre-paid fees.

This objection is made without prejudice to our rights under the agreement or under applicable data protection law.

[name]

[title]

[your company]

Three things before you send it.

01
Check the clock.
Your window runs from the vendor's notice, not the day you read it. If the notice was an edit to a web page, some of it may already be gone.
02
Send it to the right place.
Use the notice address your vendor's DPA names. If the DPA names none, use the privacy contact on its privacy page. Copy your account manager.
03
Ask for your options.
The clauses we quote give you a right to object, not a veto. Some promise only a good-faith discussion. So the letter asks what your options are.

If your agreement treats silence as approval, sending something inside the window matters more than what it says.

Find your vendor’s clause.

Paste it into the letter where it says to. Each one is word for word from an agreement the vendor publishes.

Gong5 business days
“Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …”
gong.io/legal/data-processing-addendum · read Aug 31, 2026
Airtable10 business days
“Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.”
airtable.com/dpa · read Oct 22, 2026
Algolia10 business days
“Subscriber may object to Algolia's use of a new Sub-processor by notifying Algolia promptly in writing within ten (10) business days after receipt of Algolia's notice.”
www.algolia.com/policies/data-processing-addendum · read Oct 30, 2026
DataRobot10 business days
“Customer may object to DataRobot’s use of a new Subprocessor by notifying DataRobot in writing within ten (10) business days after notice of an updated Subprocessor List.”
datarobot.com/legal/dpa · read Sep 11, 2026
Insider10 business days
“5.3 Objection Right for New Sub-processors. Customer may object to Insider One’s use of a new Sub-processor by notifying Insider One promptly in writing within ten (10) business days after receipt of Insider One’s notice in accordance with Schedule 2.”
useinsider.com/legal/dpa · read Oct 12, 2026
New Relic10 business days
“After being notified, Customer will have ten (10) business days to notify New Relic in writing of any reasonable objection it has to the new third party Sub-Processor(s).”
newrelic.com/termsandconditions/dataprotection · read Oct 9, 2026
RunPod10 business days
“Within ten (10) business days of an update to the list of Sub-Processors, Customer shall inform Runpod, in writing, of objections to any new Sub-Processors, if any.”
www.runpod.io/legal/data-processing-agreement · read Oct 29, 2026
Lovable20 business days
“In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting [email address on the vendor's page].”
lovable.dev/data-processing-agreement · read Oct 30, 2026
Anyscale5 days
“(d) Customer may object in writing to Anyscale's appointment of a new Subprocessor based on reasonable data protection concerns by emailing [email address on the vendor's page] within five (5) calendar days of notice of a new Subprocessor from Anyscale and the parties will discuss such concerns in good faith.”
anyscale.com/dpa · read Oct 3, 2026
Demandbase5 days
“Customer may object in writing to Demandbase’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Demandbase promptly in writing within five (5) calendar days of an update to the Sub-processor List referenced in Section 3.3 and the parties shall discuss Customer concerns in good faith with a view to achieving a commercially reasonable resolution.”
demandbase.com/data-processing-agreement · read Oct 24, 2026
HiddenLayer5 days
“If Subscriber does not provide written objection within such five (5) calendar day period, the Subprocessor shall be deemed approved by Subscriber.”
hiddenlayer.com/dpa · read Sep 7, 2026
Redis5 days
“Amendments to the SCC Modules Module 2 and Module 3 are hereby amended as follows, to the extent allowed by applicable law: Section Reference | Concept | Selection by the Parties | Section 1, Clause 7 | Docking Clause | Any Clause purporting to allow the admission of contracting parties without mutually executed signed writings shall not apply (including but not limited to any optional docking clauses). | Section II, Clause 9 | Approval of Subprocessor | The language of Option 2 shall apply, with General Written Authorisation in accordance with a notification period of five (5) days in advance.”
redis.io/legal/data-processing-addendum-dpa/ · read Oct 28, 2026
Vercel5 days
“If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.”
vercel.com/legal/dpa · read Oct 28, 2026
LangChain7 days
“Customer may only object to the addition of a Subprocessor within seven days of LangChain’s update based on reasonable grounds relating to a Subprocessor’s ability to protect Personal Data in accordance with Data Protection Law by providing written notice detailing the grounds of such objection.”
langchain.com/dpa · read Sep 30, 2026
Monday.com7 days
“Where Customer has not objected within such seven (7) day period in the manner described above, the use of the new Sub-Processor shall be deemed accepted by Customer.”
monday.com/l/privacy/dpa/ · read Sep 30, 2026
AssemblyAI10 days
“At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein. Customer may object to such an engagement by informing AssemblyAI within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
assemblyai.com/legal/data-processing-addendum · read Oct 29, 2026
Baseten10 days
“Objection Right for New Subprocessors.** Customer may object in writing to a new Sub-Processor based on reasonable data protection concerns by emailing [email address on the vendor's page] within ten (10) calendar days of notice.”
baseten.co/dpa · read Oct 30, 2026
Braintrust10 days
“At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and notify Customer via email. Customer may object to such an engagement by informing Company within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
braintrust.dev/legal/dpa · read Oct 8, 2026
Braze10 days
“Customer may object to Braze’s use of a new Sub-processor by notifying Braze promptly in writing within ten (10) calendar days after receipt of Braze’s notice in accordance with Section 5.2.”
marketing-assets.braze.com/production/hero/Braze-DPA-Rev-July-2024-SIGNED.pdf · read Oct 1, 2026
ClickHouse10 days
“Customer may object in writing to ClickHouse's appointment of a new Sub-Processor by notifying ClickHouse promptly in writing within ten (10) calendar days of notice of the change.”
clickhouse.com/legal/agreements/data-processing-addendum · read Oct 24, 2026
Coveo10 days
“Coveo shall inform Customer of additions or replacements of Sub-Processors by notifying Customer’s contacts who have subscribed to notifications through the Sub-Processor Page or who have been identified in the Order, thereby giving Customer the opportunity to object to such changes on data protection grounds by notifying Coveo in writing within ten (10) days of the receipt of Coveo’s notification.”
www.coveo.com/en/company/legal/terms-and-agreements/data-processing-addendum · read Nov 2, 2026
Databricks10 days
“Customer may object to Databricks’ appointment of a new Subprocessor on reasonable grounds relating to data protection by notifying Databricks in writing at [email address on the vendor's page] within ten (10) calendar days after receiving notice pursuant to Section 4.3.”
www.databricks.com/legal/dpa · read Sep 30, 2026
Hebbia10 days
“If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.”
hebbia.com/dpa · read Oct 20, 2026
LangfuseClickHouse's DPA, served at langfuse.com/dpa10 days
“Customer may object in writing to ClickHouse's appointment of a new Sub-Processor by notifying ClickHouse promptly in writing within ten (10) calendar days of notice of the change.”
langfuse.com/dpa · read Oct 24, 2026
LiveKit10 days
“If no objection has been raised within the ten (10) day period mentioned in Section 6.2, LiveKit will deem Customer to have authorized the new Sub-processor.”
livekit.io/legal/data-processing-addendum · read Nov 2, 2026
LogicMonitor10 days
“Customer may object to the engagement of such New Sub-processor by notifying LogicMonitor within ten (10) days of LogicMonitor's notification, provided that such objection must be on reasonable, substantial grounds, directly related to such New Sub-processor's ability to comply with substantially similar obligations to those set out in this Addendum (an "Objection").”
logicmonitor.com/legal/data-processing-addendum · read Oct 29, 2026
Mistral AI10 days
“The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to [email address on the vendor's page], provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.”
legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026
Poolside10 days
“At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and provide a mechanism for Customer to receive notice of that update. Customer may object to such an engagement by informing Company within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
poolside.ai/legal/dpa · read Oct 10, 2026
Toloka10 days
“If the Processor adds or changes one or more Sub-Processor(s), it will notify the Controller at least 10 days prior to any such change and provide the Controller the opportunity to object to the engagement of the new Sub-Processors on reasonable grounds relating to the protection of Personal Data within 10 days.”
toloka.ai/legal/dpa_sag · read Oct 22, 2026
Vespa10 days
“At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List. The Customer may object to such an engagement by informing Vespa.ai within this ten (10) day period, provided such objection is in writing and based on reasonable grounds relating to data protection.”
vespa.ai/data-processing-agreement · read Oct 30, 2026
Wiz10 days
“Failure to object to such Sub-Processor in writing within ten (10) days following Wiz's notice shall be deemed as acceptance of the Sub-Processor.”
wiz.io/data-processing-agreement · read Oct 23, 2026
Workato10 days
“Workato may from time to time engage new Sub-Processors, provided that at least thirty (30) days before enabling any new Sub-Processors to Process Personal Data, Workato will add such Sub-Processors to the List and notify Account Holder of such updates via the email address provided by Account Holder. Account Holder may object to such engagement in writing based on reasonable grounds within ten (10) days of receipt of the notice.”
assets.ctfassets.net/khy5qy7zbpmq/5WZQn48Q35CcQvqCsehisP/b10c6bdfe7c148771e92312154178583/Workato_Data_Processing_Addendum_Websites_2025-03-17.pdf · read Sep 30, 2026
Adobe14 days
“Adobe will provide such notification to those email addresses that have subscribed at least fourteen (14) days in advance of allowing the new Sub-processor to Process Personal Data (the “Objection Period”).”
www.adobe.com/content/dam/cc/en/legal/terms/enterprise/pdfs/DPA-WW.pdf · read Oct 1, 2026
Zapier14 days
“In the event that you do not wish to consent to the use of such additional Subprocessor, you may notify Zapier that you do not consent within fourteen (14) days of Zapier’s advance written notice based on reasonable data protection concerns.”
zapier.com/dpa · read Oct 27, 2026
Anthropic15 days
“In the event that Anthropic wishes to appoint an additional Subprocessor: (a) Anthropic will provide Customer reasonable notice of the new Subprocessor prior to giving the Subprocessor access to Customer Personal Data; and (b) Customer may, on the basis of reasonable data privacy or data security concerns, object to Anthropic’s use of such Subprocessor by providing Anthropic with written notice of the objection within fifteen (15) days of the date of such notice, or Customer is deemed to consent to the new Subprocessor.”
anthropic.com/legal/data-processing-addendum · read Oct 29, 2026
Cognition15 days
“If Customer does not object within fifteen (15) days of receiving notice, Customer shall be deemed to have accepted the updated Subprocessor list.”
cognition.ai/dpa · read Oct 27, 2026
Datadog15 days
“Objections to Subprocessors. Customer may object to a new Subprocessor on reasonable grounds related to the protection of Customer Personal Data by sending an email to [email address on the vendor's page] describing its legitimate, good-faith objection within 15 days of a Change Notice (an "Objection Notice"), in which case Datadog may satisfy the objection by (a) not using the new Subprocessor to Process Customer Personal Data;”
datadoghq.com/legal/data-processing-addendum · read Oct 9, 2026
Eightfold AI15 days
“The Customer may, within (fifteen) 15 days of the receipt of the notification, object in writing to Eightfold’s appointment of a new Subprocessor, provided that such objection is based on reasonable grounds relating to the processing of Customer Personal Data by the new Subprocessor.”
eightfold.ai/dpa · read Oct 31, 2026
Fiddler AI15 days
“When Provider engages any new Third Party after the effective date of the Agreement, Provider will notify Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating Subprocessor Site or by other written means. If Customer objects to such engagement in a written notice to Provider within 15 days after being informed of the engagement on reasonable grounds relating to the protection of Personal Data, Customer and Provider will work together in good faith to find a mutually acceptable resolution to address such objection.”
fiddler.ai/legal/dpa · read Oct 30, 2026
Freshworks15 days
“Freshworks shall provide Customer with at least 15 days’ prior notice of any planned changes to the Subprocessor list, through the addition or replacement of Subprocessors.”
www.freshworks.com/data-processing-addendum/ · read Oct 13, 2026
Groq15 days
“Customer may object in writing to the appointment of a new Subprocessor within 15 days of such notice, provided that such objection is based on reasonable grounds relating to data protection.”
console.groq.com/docs/legal/customer-data-processing-addendum · read Sep 30, 2026
Harvey15 days
“You may, within 15 days of receiving the notice of the change, reasonably object to Harvey’s use of a Subprocessor on reasonable grounds relating to the protection of Customer Personal Data (the “Objection”) by following the instructions set forth in the Subprocessor List or by contacting [email address on the vendor's page] (the “Objection Notice”).”
harvey.ai/legal/data-processing-addendum · read Nov 1, 2026
Nebius15 days
“For the purposes of Clause 9 of the SCC (concerning Module Three transfers), the Parties choose the option 2 “General Written Authorisation” in Clause 9 of the SCC shall apply, and specify that the processor shall inform in writing the controller of any intended changes of that list through the addition or replacement of Sub-processors at least fifteen (15) days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned Sub-processor(s).”
docs.nebius.com/legal/dpa · read Oct 27, 2026
Pinecone15 days
“Customer may object to Pinecone’s appointment of a new Subprocessor on reasonable data protection grounds by notifying Pinecone in writing at [email address on the vendor's page] within 15 days of an Update Notice (an “Objection Notice”).”
pinecone.io/dpa · read Oct 31, 2026
PolyAI15 days
“You must notify us if you object to the proposed change to the Authorised Sub-processors by providing us with written notice of the objection within fifteen (15) days after PolyAI has provided notice to you of such proposed change (an “Objection“).”
poly.ai/dpa · read Oct 21, 2026
Smartsheet15 days
“Customer's failure to provide written notice of objection within such fifteen (15) day period shall constitute Customer's approval and authorization of the new Subprocessor's appointment.”
smartsheet.com/legal/dpa · read Oct 27, 2026
xAI15 days
“You may object on reasonable grounds relating to data protection to our engagement of any new or replacement Subprocessor by informing us in writing within fifteen (15) days after receiving notice.”
x.ai/legal/data-processing-addendum · read Nov 2, 2026
Intercom20 days
“If Customer reasonably objects to the appointment of a new Sub-processor within twenty (20) days of receiving such notice, on reasonable grounds relating to the protection of the Customer Personal Data, then Intercom will work in good faith with Customer to find an alternative solution.”
intercom.com/data-processing-agreement · read Oct 30, 2026
Snowflake28 days
“Snowflake shall provide such notification both to (i) email addresses that have subscribed for notifications on the Sub-processor Site, and (ii) email addresses designated by Customer as ‘privacy notices’ recipients within Service, at least twenty-eight (28) days in advance of allowing the new Sub-processor to Process Customer Personal Data (the “Objection Period”).”
snowflake.com/legal/data-processing-addendum · read Oct 16, 2026
Amazon Web Services30 days
“AWS will update this page at least 30 days before engaging a new sub-processor, and if you subscribe for updates, AWS will notify you by email of changes to this page.”
aws.amazon.com/compliance/sub-processors/ · read Oct 31, 2026
Asana30 days
“4.2 Right to Object. Customer may object to Asana’s use of a new Subprocessor (based on reasonable grounds relating to data protection) by notifying Asana promptly in writing at [email address on the vendor's page] within thirty (30) days after receipt of Asana’s notice as described in Section 4.1.”
asana.com/terms/data-processing · read Oct 31, 2026
Atlassian30 days
“Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the “Sub-processor Notice Period”).”
atlassian.com/legal/data-processing-addendum · read Oct 31, 2026
Automation Anywhere30 days
“If Customer wishes to object to a new Subprocessor based on reasonable data protection concerns, it can do so within 30 days after notice of a new Subprocessor by following any process described by AAI in its notification to Customer or via registered letter sent to: Attention: Legal Department (Privacy Counsel) Automaton Anywhere, Inc. 633 River Oaks Pkwy San Jose, CA 95134 United States of America [email address on the vendor's page] AAI shall respond to such objections within a reasonable time frame so long as such objections have a reasonable basis.”
automationanywhere.com/legal/dpa · read Oct 8, 2026
Cisco30 days
“Cisco will not subcontract its obligations under this DPA to new Subprocessors, in whole or in part, without providing You with at least 30 days advance notice (e.g.: by publishing this information at Cisco’s Trust Portal and/or by email upon Your subscription at Cisco’s Trust Portal) and an opportunity to object.”
trustportal.cisco.com/c/dam/r/ctp/docs/dataprotection/cisco-master-data-protection-agreement.pdf · read Oct 1, 2026
CoreWeave30 days
“CoreWeave will update this page at least 30 days before engaging a new sub-processor.”
docs.coreweave.com/policies/terms-of-service/sub-processors · read Oct 28, 2026
Dataiku30 days
“If Customer does not object within the said period of thirty (30) days, Customer is deemed to have accepted the new Subprocessor.”
dataiku.com/legal/data-processing-addendum · read Oct 31, 2026
DocuSign30 days
“Docusign will maintain an up-to-date list of its Subprocessors, and it will provide Customer with thirty (30) days’ prior notice of any new Subprocessor added to the list.”
www.docusign.com/legal/terms-and-conditions/data-protection-attachment · read Oct 17, 2026
Elastic30 days
“Customer may object in writing to Elastic's appointment of a new Sub-processor by notifying Elastic promptly in writing within thirty (30) calendar days of Elastic notice in accordance with Section 4.1 above.”
www.elastic.co/pdf/v021423.0-elastic-customer-dpa.pdf · read Oct 1, 2026
ElevenLabs30 days
“ElevenLabs will notify Customer at least thirty (30) days prior to appointing any new or replacement Subprocessor (“Notice Period”) by updating the Subprocessor List.”
elevenlabs.io/dpa · read Nov 1, 2026
Fireflies.ai30 days
“If Customer objects to the use of a new Subprocessor, it must send an email to [email address on the vendor's page] within thirty (30) days of receiving notice of the changes, clearly indicating its desire to object.”
fireflies.ai/data-processing-agreement · read Sep 30, 2026
GitHub30 days
“GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data.”
github.com/subprocessors · read Oct 21, 2026
Google30 days
“When Google engages any New Subprocessor during the Term, Google will, at least 30 days before the New Subprocessor starts processing any Customer Data, notify Customer of the engagement (including the name, location and activities of the New Subprocessor).”
cloud.google.com/terms/data-processing-addendum · read Oct 31, 2026
Google Cloud30 days
“When Google engages any New Subprocessor during the Term, Google will, at least 30 days before the New Subprocessor starts processing any Customer Data, notify Customer of the engagement (including the name, location and activities of the New Subprocessor).”
cloud.google.com/terms/data-processing-addendum · read Oct 31, 2026
H2O.ai30 days
“Customer may object to a new Subprocessor within thirty (30) days of such notice on reasonable data protection grounds.”
h2o.ai/legal/dpa · read Oct 15, 2026
HireVue30 days
“The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).”
hirevue.com/legal/dpa · read Sep 13, 2026
HubSpot30 days
“We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you.”
legal.hubspot.com/dpa · read Oct 10, 2026
Hugging Face30 days
“6.3 When Provider engages any new Subprocessor after the effective date of the Agreement, Provider will update the Subprocessors List. If Customer objects to such engagement in a written notice to Provider within 30 days after the publication of the updated list on reasonable grounds relating to the protection of Personal Data, Customer and Provider will work together in good faith to find a mutually acceptable resolution to address such objection.”
cdn-media.huggingface.co/landing/assets/Data+Processing+Agreement.pdf · read Oct 1, 2026
Lucidworks30 days
“We will give you the opportunity to object to the engagement of new Subprocessors on reasonable grounds relating to the protection of Personal Data within 30 days of notifying you.”
lucidworks.com/legal/dpa · read Oct 1, 2026
MongoDB30 days
“We maintain a current list of our Subprocessors at: https://www.mongodb.com/products/platform/trust/subprocessors which we will update at least 30 days before the addition or replacement of any Subprocessor.”
mongodb.com/legal/dpa · read Oct 30, 2026
NVIDIA30 days
“Prior to NVIDIA engaging a new Sub-Processor for existing Services that Customer has purchased, NVIDIA will (a) notify Customer by email to Customer’s designated contact in the NVIDIA Support Portal, or by notification within the NVIDIA Support Portal (or other mechanism used to notify its customer base); and (b) provide the notice described in the preceding sentence at least 30 days before engaging a Sub-Processor.”
www.nvidia.com/en-us/agreements/data-processing-addendum/nvidia-cloud-services-data-processing-addendum/ · read Nov 1, 2026
OpenAI30 days
“Customer may object to the use of such additional Sub-processor within 30 days of receiving notice of the change by following the instructions set forth in the Sub-Processor List or by contacting [email address on the vendor's page].”
openai.com/policies/data-processing-addendum/ · read Oct 31, 2026
PagerDuty30 days
“If PagerDuty processes Customer Personal Data of residents in the European Economic Area, the United Kingdom, or Switzerland on Customer’s behalf, in order to exercise its right to object to PagerDuty’s use of a new subprocessor, Customer shall notify PagerDuty promptly in writing within thirty (30) days after PagerDuty’s updated list of subprocessors has been made available.”
www.pagerduty.com/data-processing-addendum/ · read Oct 23, 2026
Qodo30 days
“SUBCONTRACTING Service Provider may subcontract its obligations under this Data Processing Addendum to another person or entity (“Contractor(s)“) who shall act as Service Provider’s Sub-processor (as such term is defined in the Data Protection Laws), as stated in Exhibit A attached hereto. Service Provider shall inform the Customer of any intended changes concerning the addition/replacement of its Contractors at least 30 days prior to such change and Customer does not legitimately object to such changes within that time frame.”
www.qodo.ai/data-processing-addendum/ · read Aug 31, 2026
Rev30 days
“On at least 30 days’ notice to Customer, Rev may engage new Subprocessors subject to requirements of Privacy Laws.”
rev.com/legal/data-processing-addendum · read Oct 28, 2026
Salesloft30 days
“Customer will have thirty (30) days from such notice to object to the newly proposed Sub-Processor.”
salesloft.com/legal/data-processing-addendum · read Oct 23, 2026
Sema4.ai30 days
“3.5 Right to Object – Company may object in writing to Sema4.ai ’s appointment of a new Sub-Processor on reasonable grounds relating to data protection by notifying Sema4.ai in writing within thirty (30) calendar days of receipt of notice in accordance with Section 3.4 .”
sema4.ai/dpa · read Oct 31, 2026
Snyk30 days
“3.2 Snyk will provide Customer with thirty (30) day notice (the “Notice Period”) prior to adding or replacing any Sub-processor by posting details at https://snyk.io/policies/subprocessors/.”
snyk.io/dpa · read Oct 23, 2026
Splunk30 days
“4.2 Splunk will not subcontract its obligations under this DPA to new Subprocessors, in whole or in part, without providing You with at least 30 days advance notice (e.g.: by publishing this information at Cisco’s Trust Portal and/or by email upon Your subscrip- tion at Cisco’s Trust Portal) and an opportunity to object.”
www.splunk.com/content/dam/splunk2/en_us/pdfs/legal/splunk-data-protection-agreeement.pdf · read Sep 30, 2026
Weaviate30 days
“The Customer, upon being informed, may object to the appointment of that Subprocessor within 30 days on reasonable data protection grounds.”
weaviate.io/dpa · read Oct 30, 2026
Zendesk30 days
“If Customer objects, it will inform Zendesk in writing by emailing [email address on the vendor's page] within 30 days following the update to the Sub-processor Policy.”
www.zendesk.com/company/data-processing-agreement/ · read Oct 21, 2026
Zscaler30 days
“Customer may object to a new Sub-processor within thirty (30) days of such notice on reasonable grounds relating to data protection.”
www.zscaler.com/legal/data-processing-agreement · read Oct 27, 2026

A quote ending in an ellipsis is one where the vendor’s page hid part of the text from us. Email addresses are left out; the source link goes to the vendor’s own page. How we read vendor pages.

Take the letter with you.

A Word file with the letter and every clause above, as they stand the day you open it.

Common questions.

How do I object to a new sub-processor?: In writing, within the window your data processing agreement states, on grounds that relate to data protection. Quote the clause you rely on, so the vendor doesn't have to check you have the right.
Where do I send a sub-processor objection?: To the notice address your vendor's DPA names. If the DPA names none, use the privacy contact on the vendor's privacy page, and copy your account manager.
What are reasonable grounds to object to a sub-processor?: Grounds about data protection, not preference: processing in a country your own customer commitments exclude, processing outside the current scope, or customer agreements that need a consent you don't hold.
Can I block a vendor from adding a sub-processor?: Not under the clauses we quote: they give you a right to object, not a veto. Check whether your agreement gives a right to end the affected service if the objection isn't resolved.
How long do I have to object?: The clauses we've quoted run from 5 days to 30 days. The window starts at the vendor's notice, not the day you read it, so part of it may already be spent.

Read a DPA

More for this job.

See every resource

This isn’t legal advice, and the letter is a starting point, not wording anyone has approved for your situation. The clauses are from published agreements, read on the dates shown. Your signed contract governs, and it may differ from the public version. Corrections are free to request.