Right to Object to a New Subprocessor

What is the right to object to a new subprocessor?

The right to object lets you say no when your vendor plans to add a new subprocessor, the company it hires to handle your data. You use it during the notice period your vendor gives before the change.

The right comes from the GDPR, the EU privacy law. Article 28(2) says that under a general permission, the vendor must tell you about intended changes, "thereby giving the controller the opportunity to object". You are the controller: the business that decides why the data is used.

The law gives you the chance to object. Your data processing agreement (DPA) decides what that objection actually does.

What it looks like in a vendor's terms

A typical clause reads like this:

You may object to a new subprocessor in writing within the notice period, on reasonable grounds related to data protection. We will work with you in good faith to address your concern. If we cannot, your only remedy is to end the affected service.

• "In writing within the notice period" means a late or verbal objection may not count.
• "Reasonable grounds related to data protection" means you need a privacy or security reason, not just a preference.
• "Work with you in good faith" is a promise to talk, not a promise to change anything.
• "Your only remedy is to end the affected service" means the vendor can go ahead with the subprocessor. Your choice is to accept it or leave.

Atlassian's DPA, for example, calls ending the affected order your "sole and exclusive remedy".

What an objection gets you in practice

In many DPAs, objecting does not stop the change. It gives you a way out. Here is what three DPAs we opened say, as of October 2026:

• Atlassian: you may object during the 30-day notice period. Your sole remedy is to end the affected order under the termination for convenience clause of the main agreement. The DPA does not mention a refund.
• HubSpot: you may object within 30 days on reasonable data protection grounds. If it is not resolved, HubSpot may choose not to use the subprocessor, or let you suspend or end the affected service. Fees incurred before that still apply.
• Stripe: you may object within 30 days on legitimate grounds. If you do, Stripe is not obligated to provide the services that rely on that subprocessor.

The EU model contract clauses can go further. The European Commission's Q&A says that under those clauses, if you object, the processor may not engage the new subprocessor. Whether those clauses apply to you depends on your contract and where your data flows.

A real change we caught

Objections matter most when a subprocessor is not optional. Venpo flagged that Persona added ClickHouse as a required subprocessor. Persona marked it as required, so it applies to every Persona customer, not only those using one feature. When a subprocessor is required, objecting can mean giving up the product it supports.

Why it matters to you

If leaving is your only remedy, the right to object is a bargaining chip, not a veto. You are weighing the risk of the new subprocessor against the cost of switching tools.

Money is part of that. If you prepaid for a year and the DPA only lets you terminate, you may lose the rest of what you paid unless the main agreement promises a refund. Check your termination for convenience terms.

Your customers matter too. If you promised them that data stays in the EU, or that it never goes to an AI subprocessor, a vendor's change can put you in breach of your own contract. Objecting creates a record that you acted.

How to write an objection

Keep it short and send it the way the DPA says, before the deadline. A useful objection includes:

1. Your company name, account ID and the DPA you rely on.
2. The subprocessor you object to and the date of the notice.
3. Your data protection reason, such as location, security record or data type.
4. What you are asking for: not using it for your data, an alternative, or a refund if you must leave.
5. A request for written confirmation of the vendor's response.

When it makes sense to object

• The new subprocessor will receive sensitive data, such as health or financial records.
• It moves data to a country your customers did not agree to.
• It is an AI provider and you promised customers no AI processing.
• You are ready to leave, or the vendor has said it can keep your account off the new subprocessor.

What to check

• Find the objection window and who must receive the objection.
• Read what remedy the DPA gives: blocking the change, a workaround, or only termination.
• Check whether termination comes with a refund of prepaid fees.
• Check whether the EU model clauses are part of your DPA.
• Ask whether the vendor can exclude your account from the new subprocessor.

How Venpo helps

Venpo watches your vendors' subprocessor lists and DPAs and emails you when a subprocessor is added. The alert explains the change in plain English, so you can decide inside the notice window whether to object.