The subprocessor list identifies the country or region of operation for each listed entity, disclosing that some subprocessors are located in the United States and potentially other third countries outside the EEA or UK, which are subject to cross-border transfer restrictions under GDPR and UK GDPR.
This analysis describes what Datadog's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision creates a compliance dependency for EU and UK data controller customers, who must verify the applicable transfer mechanism for each third-country subprocessor as part of their transfer impact assessment obligations under GDPR Chapter V and post-Schrems II guidance.
Interpretive note: The specific countries of operation for each subprocessor and the transfer mechanisms in use could not be directly confirmed from the extracted HTML; assessment is based on standard subprocessor list structure and Datadog's known operational geography.
This provision establishes that customer data processed by Datadog may be transferred to subprocessors in the United States and other jurisdictions, which business customers must evaluate against applicable cross-border transfer requirements including Standard Contractual Clauses, the EU-US Data Privacy Framework, or equivalent UK mechanisms.
Cross-platform context
See how other platforms handle International Data Transfer Coverage and similar clauses.
Compare across platforms →Monitoring
Datadog has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
1) REGULATORY LANDSCAPE: GDPR Chapter V and UK GDPR equivalent provisions restrict transfers of personal data to third countries lacking an adequacy decision unless an appropriate transfer mechanism is in place. The EU-US Data Privacy Framework provides a potential adequacy basis for transfers to certified US entities, but its continued legal status should be monitored. Standard Contractual Clauses remain an alternative basis. Relevant enforcement authorities include EU national supervisory authorities and the UK ICO. 2) GOVERNANCE EXPOSURE: High for EU and UK customers. Each subprocessor located in a third country requires a documented transfer mechanism. Where Datadog has not provided explicit confirmation of the transfer mechanism for each subprocessor, controllers bear the residual obligation to conduct transfer impact assessments. 3) JURISDICTION FLAGS: EU/EEA and UK customers face the highest exposure. Customers in Switzerland must also consider Swiss Federal Act on Data Protection requirements. Customers in other jurisdictions with data localization requirements should assess whether any listed subprocessor's location conflicts with applicable law. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request confirmation from Datadog of the transfer mechanism applicable to each third-country subprocessor. DPAs should include provisions addressing transfer mechanisms for subprocessors. Where the EU-US Data Privacy Framework is relied upon, ongoing certification status of relevant subprocessors should be monitored. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should conduct or update transfer impact assessments for all third-country subprocessors, document the applicable transfer mechanism for each, and establish a monitoring process for changes to adequacy decisions or certification status. Particular attention should be given to subprocessors in the United States given the evolving regulatory landscape.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision creates a compliance dependency for EU and UK data controller customers, who must verify the applicable transfer mechanism for each third-country subprocessor as part of their transfer impact assessment obligations under GDPR Chapter V and post-Schrems II guidance.
This provision establishes that customer data processed by Datadog may be transferred to subprocessors in the United States and other jurisdictions, which business customers must evaluate against applicable cross-border transfer requirements including Standard Contractual Clauses, the EU-US Data Privacy Framework, or equivalent UK mechanisms.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Datadog.