August 15, 2023

Home

Stay organized with collections

Save and categorize content based on your preferences.

Cloud Data Processing

Addendum (Customers)

Last modified: August 15, 2023

This is not the current version of this document and is provided for archival purposes.

View the current version

This Cloud Data Processing Addendum (including its appendices, the “Addendum”) is incorporated into the Agreement(s) (as defined below) between Google and Customer. This Addendum was formerly known as the “Data Processing and Security Terms” under an Agreement for Google Cloud Platform or Looker (original) or the “Data Processing Amendment” under an Agreement for Google Workspace or Cloud Identity.

Table of Contents:

General Terms

**** 1. Overview

2. Definitions

3. Duration

4. Roles; Legal Compliance

5. Data Processing

6. Data Deletion

7. Data Security

8. Impact Assessments and Consultations

9. Access; Data Subject Rights; Data Export

10. Data Processing Locations

11. Subprocessors

12. Cloud Data Protection Team; Processing

Records

13. Notices

14. Interpretation

Appendix 1: Subject Matter and Details of the Data Processing

Appendix 2: Security Measures

Appendix 3: Specific Privacy Laws

European Data Protection Law

CCPA

Turkey

Israel

Appendix 4: Specific Products

Google Cloud Platform

    Bare Metal Solution (Google

Cloud Platform)

    Google Distributed Cloud Edge

(Google Cloud Platform)

    Google-Managed Multi-Cloud

(Google Cloud Platform)

    Google Cloud VMware Engine

(Google Cloud Platform)

    NetApp Volumes (Google Cloud

Platform)

Google Workspace and Cloud Identity

    AppSheet (Google Workspace)

Looker (original)

General Terms

1. Overview

This Addendum describes the parties’ obligations, including under applicable privacy, data security, and data protection laws, with respect to the processing and security of Customer Data (as defined below). This Addendum will be effective on the Addendum Effective Date (as defined below), and will replace any terms previously applicable to the processing and security of Customer Data. Capitalized terms used but not defined in this Addendum have the meaning given to them in the Agreement.

2. Definitions

2.1 In this Addendum:

• “Addendum Effective Date” means the date on which Customer accepted, or the parties otherwise agreed to, this Addendum.

“Additional Security Controls”* *means security resources, features, functionality, and controls that Customer may use at its option and as it determines, including the Admin Console, encryption, logging and monitoring, identity and access management, security scanning, and firewalls.

• “Agreement” means the contract under which Google has agreed to provide the applicable Services to Customer.

• “Applicable Privacy Law” means, as applicable to the processing of Customer Personal Data, any national, federal, European Union, state, provincial or other privacy, data security, or data protection law or regulation.

• “Audited Services”* *means the then-current Services indicated as being in-scope for the relevant certification or report at

https://cloud.google.com/security/compliance/services-in-scope . Google may not remove any Services from this URL unless they have been discontinued in accordance with the applicable Agreement.

• “Compliance Certifications” has the meaning given in Section 7.4 (Compliance Certifications and SOC