What 77 data processing agreements actually say
We read the data processing agreement each vendor publishes and recorded what it commits to: how personal data leaves the EEA, how much warning you get before a new subprocessor, how fast you hear about a breach. Here are the counts, with every agreement one click away.
How data leaves the EEA
A transfer mechanism is what makes it lawful to move personal data out of the EEA. We count only the mechanisms an agreement relies on, not ones it lists as possible. Most agreements rely on several at once, so the rows add up to more than 77.
| Mechanism the agreement relies on | Vendors | Share |
|---|---|---|
| Standard contractual clauses (any module) | 72 | 94% |
| SCC module 2 (controller to processor) | 49 | 64% |
| SCC module 3 (processor to processor) | 48 | 62% |
| SCC module 1 (controller to controller) | 16 | 21% |
| SCC module 4 (processor to controller) | 5 | 6% |
| UK Addendum to the SCCs | 51 | 66% |
| Swiss FADP clauses | 32 | 42% |
| EU-U.S. Data Privacy Framework | 33 | 43% |
| UK IDTA | 8 | 10% |
| Binding Corporate Rules | 5 | 6% |
33 agreements name the EU-U.S. Data Privacy Framework, almost always next to the standard contractual clauses rather than instead of them. Whether a vendor is actually on the DPF list today is a separate question, answered from the official register on the transfers page. 3 agreements name no mechanism we could record: Pennylane, Piwik PRO, Snowflake.
Warning before a new subprocessor
Under GDPR Art. 28(2) a processor may add a subprocessor only after telling you, so you can object. The agreement sets how much warning that is. 53 of 77 state a number of days, 21 describe how notice is given without a period, and 3 say nothing we could record.
The usual figure is 30 days. These 21 agreements give less, which is a shorter window for you to object, not a breach of anything:
| Vendor | Days | As the agreement puts it |
|---|---|---|
| Wix | 7 | At least 7 days before the change, by email to customers who subscribe to notifications via the sub-processor list |
| Aircall | 10 | 10 business days prior notice of sub-processor changes (SCC Clause 9 Option 2); notice method not stated in this part |
| Airtable | 10 | At least 10 days' written notice before authorizing new sub-processors, by email to the address in the DPA signature block |
| Amplitude | 10 | Schedule B (Subprocessor List) updated at least 10 business days before the new subprocessor gets access to Personal Data; email notification available by subscribing via [email protected] |
| Asana | 10 | 10 business days before authorization, automatic notice to customers subscribed to updates on the Subprocessors page (in an emergency, as soon as reasonably practicable) |
| Mailchimp | 10 | At least 10 days before adding or removing a subprocessor, by email to customers who subscribe via a link |
| Miro | 10 | At least 10 days prior notice of a new or replacement subprocessor, if the customer subscribes to notifications; Subprocessor List is updated |
| Mollie | 10 | Prior notice with at least 10 calendar days to object; for expedited engagements (to protect data or avoid material service disruption), notice as soon as reasonably practicable |
| Perplexity | 10 | 10 business days' prior notice of new/replacement subcontractors (other than Model Providers), via update to Trust Center Subprocessor List and in-app/in-product notification or email (email only if Customer subscribed to alerts) |
| Vanta | 10 | At least 10 days before a new sub-processor processes Personal Data: added to the list at trust.vanta.com/subprocessors and notified to subscribers. Customers who do not subscribe waive prior notice. |
| Adobe | 14 | At least 14 days before the new sub-processor processes personal data, by email to addresses subscribed via Adobe's sub-processor website |
| Langdock | 14 | At least 14 days before engagement, by publication at https://trust.langdock.com/subprocessors and by email to those subscribed on that page |
| Zapier | 14 | 14 days' advance written notice, via email, a posting, online portal notification, or other reasonable means |
| Figma | 15 | At least 15 days before processing begins; added to sub-processor list and written notice to customers subscribed to notifications |
| Freshworks | 15 | At least 15 days' prior notice of planned additions or replacements to the subprocessor list |
| Klaviyo | 15 | At least 15 days' notice of proposed additions or replacements, by email to the designated address associated with Customer's account |
| Intercom | 20 | At least 20 days prior to changes; notification via distribution list joined by emailing [email protected] |
| New Relic | 21 | 21 days' prior notice of new core third-party sub-processors, provided customer signs up for notifications at the New Relic sign-up URL |
| Make | 28 | At least 4 weeks before engaging any new sub-processor |
| Snowflake | 28 | 28 days in advance, by email to Sub-processor Site subscribers and to customer-designated 'privacy notices' recipients |
| T Cloud Public | 28 | At least four weeks in advance, express written notice to the controller of intended additions or replacements to the agreed subprocessor list |
Days are counted as each agreement writes them. Some mean business days, which is longer than the number suggests; the wording beside each figure says which.
Hearing about a breach
You have 72 hours to notify your supervisory authority of a personal data breach (GDPR Art. 33), so how fast your processor tells you matters. 18 of 77 agreements commit to a number of hours. Of the rest, 56 promise notice "without undue delay", the phrase Art. 33(2) uses, and leave the clock to you.
| Vendor | Hours | As the agreement puts it |
|---|---|---|
| Aircall | 24 | promptly after detection; no later than 24 hours after detection where European Data Protection Law applies; by email to Admin User Email Address |
| 3DS Outscale | 48 | as rapidly as possible once aware, at the latest within 48 hours, by email |
| Anthropic | 48 | without undue delay, in any event within 48 hours, in writing |
| Cursor | 48 | without undue delay, and in any event within 48 hours |
| Piwik PRO | 48 | without undue delay; if possible within 48 hours of becoming aware |
| Stripe | 48 | without undue delay; no later than 48 hours for data subject to the GDPR or UK GDPR, after becoming aware |
| Supabase | 48 | without undue delay and, where feasible, within 48 hours |
| Wire | 48 | within 48 hours |
| Zapier | 48 | without undue delay, and not later than 48 hours after discovery |
| Zendesk | 48 | without undue delay and within 48 hours of a confirmed personal data breach |
| 1Password | 72 | within 72 hours (or otherwise without undue delay) of becoming aware of a material Personal Data Breach |
| Airtable | 72 | without undue delay, and in any event no later than 72 hours after substantiation |
| Atlassian | 72 | without undue delay and, where feasible, within 72 hours of becoming aware |
| Dropbox | 72 | promptly and without undue delay; commercially reasonable efforts to notify within 72 hours of confirming a Security Incident |
| Figma | 72 | without undue delay and, where feasible, within 72 hours |
| HubSpot | 72 | without undue delay, no later than 72 hours after becoming aware |
| KnowBe4 | 72 | without undue delay and, where feasible, no later than 72 hours after becoming aware |
| Snowflake | 72 | without undue delay, and where feasible within 72 hours after becoming aware |
Transfer impact assessments
Since the Schrems II judgment, an exporter relying on standard contractual clauses has to assess whether the law of the destination country undermines them. That is your assessment to make, but a vendor can help with one. Only 13 of 77 agreements mention it at all:
| Vendor | What the agreement says |
|---|---|
| 1Password | Parties document the transfer assessment (Clause 14(b)) and make it available to the competent supervisory authority on request; importer makes best efforts to provide exporter with relevant information |
| Adobe | On written request, Adobe Ireland provides evidence of its evaluation of privacy and security controls for the third-country transfer, covering additional measures, safeguards and risk considerations |
| Anthropic | on request, information reasonably necessary for Customer to complete a TIA |
| Atlassian | Information to help customers conduct data transfer impact assessments is published (linked) |
| Cloudflare | Reasonable assistance with customer's transfer adequacy assessment, to the extent able, at customer's cost |
| Freshworks | Parties adopt additional protections required by their transfer impact assessment, if any, described in Schedule 2 |
| Grafana Labs | Data Transfer Assessment for transfers to the US, published at https://grafana.com/legal |
| Klaviyo | On request, vendor provides information reasonably necessary for customer to complete a TIA (or UK TRA); vendor may charge for TIA assistance |
| OVHcloud | Client must assess whether the SCCs are effective; OVHcloud will provide relevant information on request to assist |
| Pleo | Pleo performs transfer impact assessments as required under applicable data protection laws, including the GDPR |
| Vanta | No TIA document is provided; for transfers out of the EEA, UK or Switzerland, the parties meet as needed to consider whether the importer country's laws give broadly equivalent protection, whether extra measures are needed, and whether the transfer is still appropriate |
| Zendesk | Customer may need to perform a data transfer assessment; Zendesk provides reasonable assistance on request |
| Zoom | Zoom performs a case-by-case assessment of whether supplementary measures are needed for onward transfers to third countries |
An agreement that is silent may still be backed by a published assessment elsewhere on the vendor's site. This counts what the agreement itself commits to.
How this was counted
Each agreement is the one the vendor publishes, read between 2026-10-09 and 2026-10-12. A model transcribed the terms; every recorded term carries a verbatim quote, checked against the stored copy of the agreement, and a person reviewed it before it was published. Vendors whose agreement sits behind a login, an NDA or a download are not counted, so this is 77 of the 104 vendors in the registry, not all of them. The figures recalculate whenever an agreement is read again. The full method is on the methodology page.