The DPA requires Baseten to provide at least fifteen days advance notice of new Sub-Processor engagements via the Sub-Processor List or opt-in notification, and permits Customer to object in writing to privacy@baseten.co within five calendar days; if the objection cannot be resolved, the sole remedy available to Customer is termination of the relevant services.
This analysis describes what Baseten's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational mechanism through which GDPR Article 28 sub-processor approval obligations are managed, and limits Customer's recourse upon unresolvable sub-processor objection to termination rather than continuation of services with a different configuration, which may be operationally significant for production ML deployments.
Interpretive note: The adequacy of the five-day objection window under GDPR Article 28 and supervisory authority guidance is not definitively established in the document and may vary by jurisdiction and enforcement context.
Under this clause, Customer must actively monitor the Baseten Sub-Processor List or opt in to notifications to exercise its five-day objection window; failure to object within the window results in deemed approval of the new Sub-Processor, and the exclusive remedy for an unresolved objection is agreement termination.
Cross-platform context
See how other platforms handle Sub-Processor Notification and Objection Mechanism and similar clauses.
Compare across platforms →"Baseten shall notify Customer if it engages a new Sub-Processor at least fifteen (15) days prior to the date on which the new Sub-Processor will commence processing Customer Personal Data by updating the Sub-Processor List or by sending Customer a notification if Customer opts-in to receive such notifications in the manner made available on the Sub-processor List. Customer may object in writing to Baseten's appointment of a new Sub-Processor based on reasonable data protection concerns by emailing privacy@baseten.co within five (5) calendar days of notice of the new Sub-Processor and the parties will discuss such concerns in good faith. If the parties are unable to reach a mutually agreeable solution, Baseten will either (a) use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; or (b) where: (i) such a change cannot be made within thirty (30) days from Baseten's receipt of Customer's objection; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy.Excerpt from Baseten's Terms of Service
(1) REGULATORY LANDSCAPE: This provision directly implements GDPR Article 28(2) and (4) requirements for processor-to-sub-processor authorization and notification, and mirrors the general written authorization model described in EU SCCs Clause 9 Option 2.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the operational mechanism through which GDPR Article 28 sub-processor approval obligations are managed, and limits Customer's recourse upon unresolvable sub-processor objection to termination rather than continuation of services with a different configuration, which may be operationally significant for production ML deployments.
Under this clause, Customer must actively monitor the Baseten Sub-Processor List or opt in to notifications to exercise its five-day objection window; failure to object within the window results in deemed approval of the new Sub-Processor, and the exclusive remedy for an unresolved objection is agreement termination.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Baseten.