The document lists each subprocessor by name alongside the country or region in which that entity operates and the processing purpose for which it is engaged, providing data controllers with the information required to conduct cross-border transfer assessments.
This analysis describes what Datadog's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision fulfills the disclosure component of GDPR Article 28 obligations, enabling data controllers to identify the full chain of subprocessing entities and assess whether appropriate transfer mechanisms are in place for each entity, particularly for processors located in third countries such as the United States.
Interpretive note: The full text of the subprocessor list entries was not extractable from the HTML provided; the description is based on the document structure and standard subprocessor list conventions rather than verbatim clause language.
This provision establishes a named disclosure of each third-party processor, their country of operation, and their processing function, which business customers operating as data controllers must reconcile against their own compliance documentation and data transfer impact assessments.
Cross-platform context
See how other platforms handle Subprocessor Identity and Location Disclosure and similar clauses.
Compare across platforms →Monitoring
Datadog has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
1) REGULATORY LANDSCAPE: GDPR Article 28(2) and (4) require that processors obtain controller authorization before engaging subprocessors and impose equivalent data protection obligations downstream. This disclosure directly addresses Article 28(1) transparency requirements. Relevant enforcement authorities include EU national supervisory authorities and, for UK customers, the ICO. Where subprocessors are located in third countries, Chapters V of GDPR and UK GDPR govern the lawfulness of transfers. 2) GOVERNANCE EXPOSURE: Medium. The list names entities across multiple jurisdictions including the United States, which requires evaluation of applicable transfer mechanisms such as Standard Contractual Clauses or coverage under the EU-US Data Privacy Framework. Failure by a controller to verify these mechanisms before data transfer may constitute a compliance gap under applicable law. 3) JURISDICTION FLAGS: EU/EEA and UK customers face the highest exposure given GDPR and UK GDPR transfer restrictions. California customers should assess whether any listed subprocessors involve service providers under CCPA. Customers in regulated sectors such as healthcare or financial services may have additional sector-specific vendor approval requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that their DPA with Datadog includes a provision authorizing general subprocessing and establishing a notification right for changes. The list does not itself confirm that Datadog has executed DPAs with each subprocessor, which is a due diligence item for controllers relying on this disclosure. 5) COMPLIANCE CONSIDERATIONS: Controllers should update their Records of Processing Activities to reflect all listed subprocessors, conduct transfer impact assessments for third-country processors, and ensure internal vendor risk registers are current. Any subprocessor handling special category data warrants additional scrutiny.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision fulfills the disclosure component of GDPR Article 28 obligations, enabling data controllers to identify the full chain of subprocessing entities and assess whether appropriate transfer mechanisms are in place for each entity, particularly for processors located in third countries such as the United States.
This provision establishes a named disclosure of each third-party processor, their country of operation, and their processing function, which business customers operating as data controllers must reconcile against their own compliance documentation and data transfer impact assessments.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Datadog.