Notice clauses
What does a sub-processor notice clause make you do?
Your AI vendor’s data processing agreement (DPA) lets it add sub-processors, companies it hands your data to. It tells you, and the clause sets how long you get to object or how much notice comes first.
Every quote below comes from an agreement we read on the date shown.
The clock starts at their notice, not when you find out.
The window opens when the vendor publishes or notifies. A week spent not knowing is a week of the window gone.
days: the shortest window we can quote. See every window.
When the window opens, in their words.
One counts from the vendor’s notice, the other from an update to its list. Neither counts from the day you see it.
Vercel
“If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.”
Demandbase
“Customer may object in writing to Demandbase’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Demandbase promptly in writing within five (5) calendar days of an update to the Sub-processor List referenced in Section 3.3 and the parties shall discuss Customer concerns in good faith with a view to achieving a commercially reasonable resolution.”
In some agreements, saying nothing means yes.
A missed window isn’t a decision put off. In 10 of the 81 clauses we quote, saying nothing in time counts as approval. More clauses like this.
HiddenLayer
“If Subscriber does not provide written objection within such five (5) calendar day period, the Subprocessor shall be deemed approved by Subscriber.”
“We will notify you” can mean several things.
The clauses don’t agree on what notice is. Some send an email. Some publish to a page. Some send an email only to an address that subscribed first.
When notice is a page, the window opens when the list changes, whether or not anyone is reading it.
Vespa
“At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List. The Customer may object to such an engagement by informing Vespa.ai within this ten (10) day period, provided such objection is in writing and based on reasonable grounds relating to data protection.”
AssemblyAI
“At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein. Customer may object to such an engagement by informing AssemblyAI within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
An objection has to be in writing, with reasons.
It goes in writing to a named address, and it rests on stated data-protection grounds, not preference.
In 6 of the clauses we quote, what follows is a good-faith discussion of the concern.
Mistral AI
“The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to [email address on the vendor's page], provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.”
Business days and calendar days aren’t the same.
Both appear in the agreements we hold. Airtable states 10 business days, which covers more of the calendar than the same number of days.
A tracker that stores “days” and drops the unit will get the date wrong.
Airtable
“Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.”
What the clause asks of you, in order.
Know your vendors.
Which vendors process your customers' data, and which of their agreements carry this clause.
Notice the change.
Find out when one of their lists changes. Where notice is a published page, that means re-reading the page.
Compare the lists.
Check the new list against the last one, and see what was added or removed.
Decide, in time.
Object or don't, inside the window, in writing, on data-protection grounds.
Tell your customers.
If your agreements with them carry a matching clause. Their window usually starts when you notify them.
Steps two and three are what Xither does. How it works.
Try it free for 14 daysNo card. Nothing to cancel.
This isn’t legal advice.
It quotes published agreements on the dates shown. Your negotiated contract may say something else, and it governs.
Written by Xither. Every vendor quote is pulled from what we hold when this page is served, with its source, the date we read it and a fingerprint (SHA-256 hash) of our dated copy.