The change

Deputy makes workforce software for “scheduling, time and attendance, task management, business procedure management, payroll integration” and related tools. On October 27, 2026, it updated its Data Processing Addendum (DPA). The previous version was dated June 1, 2026.

The same day, Deputy also updated its subprocessor list, the page that names the outside companies that may process customer data. That page was also last dated June 1, 2026.

What changed

• No more notice by default. Alerts about new subprocessors now go only to customer contacts who opted in.

• No more notice in advance. The promise of notice 20 days before a new subprocessor is added is gone.

• A different objection clock. The 20 days to object now run from the date the alert email is sent.

• Two new subprocessors. Anthropic and ClickHouse were added to the list.

• A shorter list. 19 vendors were removed, and the list went from 50 entries to 32.

From a promise to an opt-in

The June version of Section 2.11 said: “Deputy shall notify Customer if it adds any new Sub-processors at least 20 days before the proposed addition, in order to allow Customer to raise any reasonable objections on grounds of data protection.”

The October version says: “Deputy will send email alerts of new Sub-processors only to Customer contacts that have specifically opted in through Deputy’s Communications Preferences Center.” It adds: “Customer will have 20 days from the date Deputy sends the email alert to raise a reasonable objection on data-protection grounds.”

Two things changed at once. Notice used to be Deputy’s duty to the customer. Now it depends on someone at the customer signing up in Deputy’s Communications Preferences Center. And the 20 days used to come before the new subprocessor was added. Now they count from the email, and the DPA does not say when that email goes out.

If nobody on your team opted in

The DPA does not say that anyone else will be told. It also does not say when the 20 days start for a customer that never gets an email.

The right to object stays in the DPA, and so does the exit. If you reject a new subprocessor and Deputy cannot run its service without it, “Customer may terminate the Agreement.” Both rights are harder to use if you never hear about the new subprocessor.

For EU data transfers, Section 2.12 still says that “the time period for prior notice of Sub-processor changes is as set out in Section 2.11.” Section 2.11 now sets that period from the date of the email, not before the change.

What Deputy added the same day

The updated subprocessor list adds two companies:

• Anthropic, PBC for “Internal productivity,” in the United States. OpenAI was already listed for the same purpose.

• ClickHouse, Inc. for “Data storage and analytics,” in the United States.

Under the June DPA, customers were promised notice of additions like these 20 days in advance. Under the October DPA, only contacts who opted in are promised an email.

Other changes in the update

• Removed vendors. 19 vendors are no longer on the list, including Salesforce, Marketo, PayPal, Adyen, Okta, Segment and Zuora.

• Regional limits. Paycor is now listed for “U.S. customers only,” and Microkeeper and SuperAPI for “Australian customers only.”

• Merged and renamed entries. Google Apps and Google Cloud became one entry for “Google, L.L.C.,” and DropboxSign is now listed as Dropbox International Unlimited Company.

• AI hosting note removed. The list no longer says that “Customer data submitted to or generated through certain AI Features will be processed in the United States, regardless of your selected hosting region.”

What improved

• The list names fewer outside companies: 32 entries instead of 50.

• Some vendors now apply only to customers in one country, so they no longer appear to cover everyone.

• Your right to object to a new subprocessor, and to leave if Deputy cannot work without it, is still in the DPA.

Why this matters

Deputy holds sensitive employee data. Its DPA lists “passport details, social security numbers,” bank account details, “shift and attendance records” and “performance appraisals,” plus special categories such as biometric information and data concerning health.

A subprocessor notice is how you learn that a new company can reach that data. Other vendors add subprocessors often: Persona added ClickHouse as a required subprocessor, RingCentral adds AI subprocessors almost every month, and at least 30 vendors added Anthropic as a subprocessor since September. The same week, Twilio’s subprocessor list stopped covering its beta services.

When notice depends on an opt-in, it is safer not to rely on vendor emails. That is the case for monitoring AI subprocessors in your vendor stack and for monitoring vendor terms of service yourself.

Potential impact

If you use Deputy, check four things:

• Has anyone at your company opted in to subprocessor alerts, and will that person still be there next year?

• Did anyone on your team get an email about Anthropic or ClickHouse?

• Do your own privacy notices or customer contracts promise advance notice of the vendors that handle employee data?

• Did you sign a separate DPA with Deputy that keeps the old notice terms?

How Venpo detected it

Venpo monitors Deputy’s legal pages and compared both documents line by line with their June versions. The redlines are on the Deputy DPA change page and the Deputy subprocessor list change page. Every quote in this article was checked against them, and both pages were unchanged when Venpo checked them again on November 8, 2026.

Business outcome

Teams that see this change can opt in now and still use their 20 days the next time Deputy adds a subprocessor. Teams that rely on vendor emails may never hear about it. That gap is why continuous monitoring of vendor legal changes belongs in continuous vendor risk monitoring.

Key takeaway

Since October 27, 2026, Deputy emails subprocessor alerts only to customer contacts who opted in, counts your 20 days to object from that email, and added Anthropic and ClickHouse to its list on the same day.