April 11, 2023

Home

Stay organized with collections

Save and categorize content based on your preferences.

# Google-Managed
Multi-Cloud Services Data Processing Amendment

Last modified: April 11, 2023

This is not the current version of this document and is provided for archival
purposes.

View the current version

This Google-Managed Multi-Cloud Services Data
Processing Amendment (this “Amendment”) supplements and
amends the Cloud Data Processing Addendum (“CDPA”)
solely with respect to the Google-Managed Multi-Cloud
Services (“Google-Managed MCS”). Capitalized terms used
but not defined in this Amendment have the meaning given
to them in the Agreement, including, without limitation,
Section 6 (Google-Managed Multi-Cloud Services
Terms)** **of the Service Specific Terms, General
Service Terms.

This Amendment sets out amendments to the CDPA needed
to address the multi-cloud delivery model where Customer
chooses to use the Google-Managed MCS. The terms of this
Amendment apply only to Google’s processing of
Multi-Cloud Customer Data (as defined below) stored in
Customer’s selected Multi-Cloud Service Third-Party
Provider’s infrastructure pursuant to Google’s provision
of the Google-Managed MCS. Customer will have a separate
agreement in place with Customer’s selected Multi-Cloud
Service Third-Party Provider governing the Multi-Cloud
Service Third-Party Provider’s processing of Customer’s
data on behalf of Customer (“Multi-Cloud Service Data
Processing Terms”).

1. Customer Data

For the purposes of this
Amendment and the CDPA, Customer Data will include data
provided by or on behalf of Customer or Customer End Users
to Google via the Google-Managed MCS under the Account
(“Multi-Cloud Customer Data”).

2. Multi-Cloud Service Third-Party Providers

   - 2.1.
*Authorization to Engage Multi-Cloud Service Third-Party Provider*.
Customer selects the Multi-Cloud Service Third-Party
Provider on whose infrastructure the Google-Managed MCS
are deployed. The process to make the selection of the
Multi-Cloud Service Third-Party Provider will be
explicitly documented in the Documentation for the
Google-Managed MCS. Customer specifically authorizes the
engagement of Customer’s selected Multi-Cloud Service
Third-Party Provider and their subprocessors (as
referenced in the Multi-Cloud Service Data Processing
Terms) to process the Multi-Cloud Customer Data in
connection with Google’s provision of the Google-Managed
MCS.

   - 2.2.
*Information about Multi-Cloud Service Third-Party*
*Providers*. The available Multi-Cloud Service
Third-Party Providers are listed at

https://cloud.google.com/terms/mcs-providers
(as may be updated by Google from time to time).

   - 2.3.
*Requirements for Multi-Cloud Service Third-Party*
*Provider Engagement*. When engaging Customer’s
selected Multi-Cloud Service Third-Party Provider in
connection with the Google-Managed MCS, Google will:

a. ensure via a written
contract that the Multi-Cloud Service Third-Party Provider
only accesses and uses the Multi-Cloud Customer Data to
the extent required to perform the obligations
subcontracted to it;

b. enter into a data
processing agreement with the Multi-Cloud Service
Third-Party Provider that imposes the data protection
obligations described in Article 28(3) of the GDPR on the
Multi-Cloud Service Third-Party Provider for its
processing of any personal data within the Multi-Cloud
Customer Data; and

c. remain fully liable for
all obligations subcontracted to, and all acts and
omissions of, the Multi-Cloud Service Third-Party Provider
in the provision of the Google-Managed MCS.

   - 2.4.
*Multi-Cloud Service Third-Party Provider Changes*.
Google will not change Customer’s selected Multi-Cloud
Service Third-Party Provider. Customer is responsible for
and in control of which Multi-Cloud Service Third-Party
Provider may process the Multi-Cloud Customer Data, and
may change or revoke its Multi-Cloud Service Third-Party
Provider selection at any time. Information about changes
to the Multi-Cloud Service Third-Party Provider’s
subprocessors is available in the Multi-Cloud Service
Third-Party Provider’s data processing terms.

3. Data Security

   - 3.1.
*Security Measures*.

*a. Google Infrastructure*. The Security Measures
described in Appendix 2 of the CDPA apply to Customer Data
that Google processes pursuant to Google’s provision of
the Google-Managed MCS on Google’s infrastructure.

*b. Multi-Cloud Service Third-Party Provider Infrastructure*.
Where Customer Data that Google processes via the
Google-Managed MCS is processed on the Multi-Cloud Service
Third-Party Provider’s infrastructure, for any security
measures described in Appendix 2 of the CDPA that are
managed solely by the Multi-Cloud Service Third-Party
Provider, such as physical security for the applicable
data centers, Google will rely on the security measures
implemented and maintained by the applicable Multi-Cloud
Service Third-Party Provider.

   - 3.2.
*Customer’s Audit Rights*. The Multi-Cloud Service
Data Processing Terms describe Customer’s right to
directly audit and inspect the Multi-Cloud Service
Third-Party Provider. Section 7.5.2 (Customer’s Audit
Rights) of the CDPA only applies to Google’s processing of
Multi-Cloud Customer Data stored in Google’s
infrastructure pursuant to Google’s provision of the
Google-Managed MCS.

4. Effect of this Amendment

To the extent of any conflict
or inconsistency between this Amendment and the remaining
terms of the Agreement, this Amendment will govern.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],[],[],[]]