This provision establishes an opt-in notification mechanism through which customers can receive advance notice of new sub-processors for services they actively subscribe to, accessed by completing a designated form.
This analysis describes what Slack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Under GDPR Article 28, controllers are entitled to object to changes in sub-processor arrangements. This provision establishes the operational mechanism through which Salesforce delivers advance sub-processor change notifications, making subscription to this mechanism a compliance dependency for organizations that need to exercise sub-processor objection rights under their DPAs.
Interpretive note: The document does not specify the advance notice period provided through the notification mechanism, which is material to assessing whether the mechanism satisfies GDPR Article 28 objection opportunity requirements under applicable DPA terms.
The agreement establishes that sub-processor change notifications are delivered on an opt-in basis only; customers who do not subscribe to the notification form will not receive advance notice of new sub-processors added to services they use. Subscription requires completing a separate form, as stated in the document.
Cross-platform context
See how other platforms handle Sub-processor Notification Subscription Mechanism and similar clauses.
Compare across platforms →Monitoring
Slack has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Salesforce Customers may subscribe to notifications of new sub-processors for those Covered Services for which Customer has a then-current active subscription by filling out this form.— Excerpt from Slack's Slack Sub-Processors (Salesforce)
(1) REGULATORY LANDSCAPE: GDPR Article 28(2) requires that processors inform controllers of intended sub-processor changes and provide the controller an opportunity to object. This provision represents Salesforce's disclosed mechanism for satisfying that obligation. The adequacy of an opt-in notification model as a mechanism for satisfying Article 28 notice obligations may require evaluation under applicable supervisory authority guidance. Relevant enforcement authorities include EU national data protection authorities and the UK ICO. (2) GOVERNANCE EXPOSURE: Medium. Organizations that have not subscribed to the notification form may not receive timely advance notice of sub-processor changes, which could affect their ability to exercise contractual objection rights within any notice period specified in their DPA. The document does not specify the advance notice period provided through this mechanism. (3) JURISDICTION FLAGS: Heightened exposure exists for EU and EEA customers whose DPAs require a specific advance notice period before a new sub-processor is engaged. UK GDPR obligations mirror this requirement. Organizations acting as processors on behalf of their own customers face downstream notification obligations that depend on receiving timely upstream notice from Salesforce. (4) CONTRACT AND VENDOR IMPLICATIONS: Legal teams should confirm that their DPA with Salesforce specifies the notice period Salesforce commits to provide before engaging new sub-processors, and that the notification subscription mechanism delivers notice within that period. Organizations that act as data processors for their own customers should assess whether the Salesforce notification mechanism provides sufficient lead time to fulfill their own sub-processor notification obligations. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that their organization has subscribed to the Salesforce sub-processor notification form for all active service subscriptions, document this subscription as part of vendor management records, and establish an internal process for reviewing sub-processor change notifications against existing data transfer impact assessments and DPA obligations.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Under GDPR Article 28, controllers are entitled to object to changes in sub-processor arrangements. This provision establishes the operational mechanism through which Salesforce delivers advance sub-processor change notifications, making subscription to this mechanism a compliance dependency for organizations that need to exercise sub-processor objection rights under their DPAs.
The agreement establishes that sub-processor change notifications are delivered on an opt-in basis only; customers who do not subscribe to the notification form will not receive advance notice of new sub-processors added to services they use. Subscription requires completing a separate form, as stated in the document.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Slack.