Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The DPA requires Baseten to provide at least fifteen days advance notice of new Sub-Processor engagements via the Sub-Processor List or opt-in notification, and permits Customer to object in writing to privacy@baseten.co within five calendar days; if the objection cannot be resolved, the sole remedy available to Customer is termination of the relevant services.
This analysis describes what Baseten's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational mechanism through which GDPR Article 28 sub-processor approval obligations are managed, and limits Customer's recourse upon unresolvable sub-processor objection to termination rather than continuation of services with a different configuration, which may be operationally significant for production ML deployments.
Interpretive note: The adequacy of the five-day objection window under GDPR Article 28 and supervisory authority guidance is not definitively established in the document and may vary by jurisdiction and enforcement context.
Under this clause, Customer must actively monitor the Baseten Sub-Processor List or opt in to notifications to exercise its five-day objection window; failure to object within the window results in deemed approval of the new Sub-Processor, and the exclusive remedy for an unresolved objection is agreement termination.
Cross-platform context
See how other platforms handle Sub-Processor Notification and Objection Mechanism and similar clauses.
Compare across platforms →Monitoring
Baseten has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Baseten shall notify Customer if it engages a new Sub-Processor at least fifteen (15) days prior to the date on which the new Sub-Processor will commence processing Customer Personal Data by updating the Sub-Processor List or by sending Customer a notification if Customer opts-in to receive such notifications in the manner made available on the Sub-processor List. Customer may object in writing to Baseten's appointment of a new Sub-Processor based on reasonable data protection concerns by emailing privacy@baseten.co within five (5) calendar days of notice of the new Sub-Processor and the parties will discuss such concerns in good faith. If the parties are unable to reach a mutually agreeable solution, Baseten will either (a) use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; or (b) where: (i) such a change cannot be made within thirty (30) days from Baseten's receipt of Customer's objection; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy.Excerpt from Baseten's Terms of Service
(1) REGULATORY LANDSCAPE: This provision directly implements GDPR Article 28(2) and (4) requirements for processor-to-sub-processor authorization and notification, and mirrors the general written authorization model described in EU SCCs Clause 9 Option 2. The UK GDPR imposes equivalent requirements. The five-day objection window is shorter than some market practice and may require evaluation against the GDPR requirement that customers have a genuine opportunity to object. (2) GOVERNANCE EXPOSURE: Medium. The notification mechanism is conditioned on Customer opting in to active notifications via the Sub-Processor List platform; customers who do not opt in must proactively monitor the list to identify changes within the five-day window. The sole remedy of termination upon unresolvable objection may create operational continuity risk for customers with production deployments. (3) JURISDICTION FLAGS: EU and UK customers have heightened exposure under GDPR and UK GDPR sub-processor authorization requirements. The five-calendar-day objection period is notably short; GDPR supervisory authorities have in some guidance suggested that objection periods should be sufficient to allow meaningful review, though no specific minimum period is mandated in the regulation. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should implement an operationalized workflow to monitor the Sub-Processor List at trust.baseten.co and ensure opt-in to notifications is active for production accounts. The clause assigns to Customer the cost of any service change required to accommodate an objection where Baseten cannot make a commercially reasonable change at its own expense. (5) COMPLIANCE CONSIDERATIONS: Data protection officers at organizations subject to GDPR should confirm that the general written authorization model and fifteen-day advance notice period satisfy their obligations under Article 28 and any applicable supervisory authority guidance on sub-processor management. The five-day objection window should be reflected in internal vendor management procedures.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the operational mechanism through which GDPR Article 28 sub-processor approval obligations are managed, and limits Customer's recourse upon unresolvable sub-processor objection to termination rather than continuation of services with a different configuration, which may be operationally significant for production ML deployments.
Under this clause, Customer must actively monitor the Baseten Sub-Processor List or opt in to notifications to exercise its five-day objection window; failure to object within the window results in deemed approval of the new Sub-Processor, and the exclusive remedy for an unresolved objection is agreement termination.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Baseten.