Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document offers a subscription mechanism for customers to receive notifications when new third-party sub-processors are added. Customers can sign up via a linked form, and questions or concerns can be directed to privacy@openai.com.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a voluntary notification mechanism for sub-processor changes, which is relevant to enterprise customers who need to track sub-processor additions for GDPR Article 28 compliance or contractual DPA obligations that may require advance notice of sub-processor changes.
Interpretive note: The document does not specify the notice period provided before new sub-processors become active, nor whether a formal objection right is included, which limits assessment of whether this mechanism satisfies GDPR Article 28(2) requirements without reference to the full DPA text.
The document establishes a voluntary opt-in notification system for new sub-processor additions. Customers who do not subscribe to this service will not receive proactive notice of sub-processor changes and would need to monitor the published list independently.
Cross-platform context
See how other platforms handle Sub-processor Notification Subscription and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Subscribe to new Sub-processor notifications Sign up to receive notification of new third party Subprocessors by filling out this form. Please contact privacy@openai.com with any questions or concerns.Excerpt from OpenAI's Sub-Processor List
1. REGULATORY LANDSCAPE: GDPR Article 28(2) requires that processors inform controllers of intended changes to sub-processors and provide the controller with the opportunity to object. The notification subscription mechanism described in this document is one operational approach to satisfying this obligation, though the document does not specify the notice period provided or whether an objection right is formally preserved. Relevant enforcement authorities are EU supervisory authorities and the UK ICO for UK-based customers. 2. GOVERNANCE EXPOSURE: Medium. The voluntary nature of the subscription means customers who do not actively opt in may not receive timely notice of new sub-processors. Enterprise DPAs often require advance written notice of sub-processor changes (commonly 30 days), and customers should confirm whether OpenAI's DPA provides this independent of the subscription mechanism. 3. JURISDICTION FLAGS: EU/EEA and UK customers have the most direct regulatory exposure, as GDPR and UK GDPR impose specific obligations on processors regarding sub-processor change notification. California customers may have contractual CCPA service provider chain management obligations that similarly require notice of sub-processor changes. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise DPA negotiations with OpenAI should address the notice period for sub-processor additions and the mechanism for exercising objection rights. The subscription form referenced in the document is a supplementary tool and may not substitute for contractual notification obligations in a negotiated DPA. 5. COMPLIANCE CONSIDERATIONS: Legal and compliance teams should subscribe to the notification service and establish an internal workflow for reviewing new sub-processor additions, including assessment of transfer implications and DPA consistency. The privacy@openai.com contact should be documented as the point of contact for sub-processor concerns.
This provision establishes a voluntary notification mechanism for sub-processor changes, which is relevant to enterprise customers who need to track sub-processor additions for GDPR Article 28 compliance or contractual DPA obligations that may require advance notice of sub-processor changes.
The document establishes a voluntary opt-in notification system for new sub-processor additions. Customers who do not subscribe to this service will not receive proactive notice of sub-processor changes and would need to monitor the published list independently.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.