Skip to main content
Open questionOpen question

Is a subprocessor change notice period actually enforceable?

Article 28 of the General Data Protection Regulation says a processor may not engage another processor without the controller's authorisation, and vendors implement that as a notice email plus an objection window. What the controller can do if the objection is refused, short of terminating a contract it depends on, is the part nobody has settled in practice.

The verdict

Open question

No settled answer exists. The ledger poses the question, links the live debate, and does not answer it.

Key facts

What the sources say

Record ID
AVD-2026-0029
Kind
Open question
Jurisdiction
European Union
Last verified
Added
  • Article 28 of the General Data Protection Regulation states that the processor shall not engage another processor without prior specific or general written authorisation of the controller.
  • OpenAI's addendum gives the customer 30 days to object after notice of a new subprocessor.
  • Mistral's addendum operates on a general authorisation with a change notice, and the list itself lives on a trust centre outside the contract.
  • Several vendors publish the list on a client side portal that did not render its entries on the day of checking, so the notice arrives faster than the list can be read.

Figures

Every number, with who measured it and when

  1. 30 days

    Objection window after notice of a new subprocessor in one vendor addendum

    OpenAI data processing addendum, primary source, as of .

What it changes

For a buyer or a workplace AI policy

Subscribe to the notification feed for every vendor you depend on and record who in your organisation reads it, because the window starts when the notice is sent, not when someone notices. Then decide in advance what an objection would actually mean for you. A right you would never exercise because the service is load bearing is a governance line item, not a control, and it is better to know that before an auditor asks.

Sources

What this record was verified against

  1. General Data Protection Regulation, Article 28Secondary · 15 September 2026
  2. OpenAI data processing addendumPrimary · 1 January 2026
  3. Mistral AI data processing addendumPrimary · 27 July 2026

Related

Records that sit beside this one

Cite this record

Free to reuse under CC BY 4.0, with attribution. The record ID AVD-2026-0029 is permanent and is never reused.

In a sentence
According to the GAGE AI Vendor Data Ledger (as of 15 September 2026), is a subprocessor change notice period actually enforceable?.
APA
GAGE (Global Academy of Generative-AI Education). (2026). Is a subprocessor change notice period actually enforceable?. AI Vendor Data Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/ai-vendor-data-ledger/records/AVD-2026-0029-is-a-subprocessor-notice-period-enforceable
MLA
"Is a subprocessor change notice period actually enforceable?." AI Vendor Data Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/ai-vendor-data-ledger/records/AVD-2026-0029-is-a-subprocessor-notice-period-enforceable.
Chicago
GAGE (Global Academy of Generative-AI Education). "Is a subprocessor change notice period actually enforceable?." AI Vendor Data Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/ai-vendor-data-ledger/records/AVD-2026-0029-is-a-subprocessor-notice-period-enforceable.
Permalink
https://www.gage.academy/tools/ai-vendor-data-ledger/records/AVD-2026-0029-is-a-subprocessor-notice-period-enforceable

Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any terms change a vendor announces.

Back to the full ledger, or every record for European Union and every open question record.

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.

Powered by GAGE, free EU AI Act tools from the Global Academy of Generative-AI Education
CallEmailHelp