Home
Stay organized with collections
Save and categorize content based on your preferences.
Cloud Data Processing
Addendum (Customers)
Last modified: August 21, 2025
This is not the current version of this document
and is provided for archival purposes.
View the current version
This Cloud Data Processing Addendum (including its
appendices, the “Addendum”) is incorporated into
the Agreement(s) (as defined below) between Google and
Customer. This Addendum was formerly known as the “Data
Processing and Security Terms” under an Agreement for
Google Cloud Platform, Looker (original), Google
SecOps Services, or Google Cloud Skills Boost for Organizations; the
“Data Processing Amendment” under an Agreement for Google Workspace or
Cloud Identity; and the “Data Processing Addendum” under an Agreement for
Mandiant Consulting Services and Managed Services.
1. Overview
This Addendum describes the parties’ obligations,
including under applicable privacy, data security, and
data protection laws, with respect to the processing and
security of Customer Data (as defined below). This
Addendum will be effective on the Addendum Effective Date
(as defined below), and will replace any terms previously
applicable to the processing and security of Customer
Data. Capitalized terms used but not defined in this
Addendum have the meaning given to them in the Agreement.
2. Definitions
2.1 In this Addendum:
- “Addendum Effective Date” means the date
on which Customer accepted, or the parties otherwise
agreed to, this Addendum.
“Additional Security Controls”* *means
security resources, features, functionality, and
controls that Customer may use at its option and as it
determines, including the Admin Console, encryption,
logging and monitoring, identity and access management,
security scanning, and firewalls.
-
“Agreement” means the contract under which
Google has agreed to provide the applicable Services to
Customer.
-
“Applicable Privacy Law” means, as applicable
to the processing of Customer Personal Data, any
national, federal, European Union, state, provincial or
other privacy, data security, or data protection law or
regulation. For clarity, Applicable Privacy Laws include but are not
limited to the laws mentioned in Appendix 3 (Specific Privacy
Laws).
-
“Audited Services”* *means the
then-current Services indicated as being in-scope for
the relevant certification or report
at
https://cloud.google.com/security/compliance/services-in-scope
.
Google may not remove any Services from this URL unless
they have been discontinued in accordance with the
applicable Agreement.
-
“Compliance Certifications” has the meaning
given in Section 7.4 (Compliance Certifications and SOC
Reports).
-
“Customer Data”, if not defined in the
Agreement, has the meaning given in Appendix 4 (Specific
Products).
-
“Customer Personal Data” means the
personal data contained within the Customer Data,
including any special categories of personal data or
sensitive data defined under Applicable Privacy Law.
-
“Data Incident” means a breach of Google’s
security leading to the accidental or unlawful
destruction, loss, alteration, unauthorized disclosure
of, or access to, Customer Data on systems managed by or
otherwise controlled by Google.
-
“EMEA”* *means Europe, the Middle
East and Africa.
-
“EU GDPR” means Regulation (EU) 2016/679
of the European Parliament and of the Council of 27
April 2016 on the protection of natural persons with