A material change is a vendor terms, privacy, or DPA edit that shifts your risk posture — the change your control framework assumes you'll catch.
Published 2026-07-21 · updated 2026-09-23
A material change is an edit to a vendor's terms of service, privacy policy, data processing agreement, or subprocessor list that meaningfully shifts your risk posture — as opposed to a typo fix, a re-worded sentence, or a formatting change. It is precisely the change your control framework expects you to notice.
Vendors change their legal documents often, and most edits are immaterial: a clarified sentence, an updated address, a reordered section. Buried among them are the few that matter — a new AI subprocessor, a broadened data-use grant, a shortened breach-notification window, a weakened deletion commitment. The work is not detecting that something changed; it is deciding whether this change moves your risk.
ISO 27001 (control A.5.22), DORA's subcontracting technical standards, GDPR Article 28(2) for subprocessors, and SOC 2's vendor-management criterion (CC9.2) all expect you to keep track of how your vendors change. None of them monitor the documents for you. That gap — between the obligation to know and the ability to know — is exactly where ongoing monitoring lives.
Driftline separates the material changes from the edits that don't matter and surfaces the ones that move your posture — with the exact wording that changed behind every flagged change.
Paste your vendor list and confirm your email, and we build your report and email it to you — the material changes across your vendors in the last 12 months, which of them added AI subprocessors or reserved the right to train on your data, and where your nth-party exposure concentrates. Free.