Data Act Addendum (EU Data Act)
Last Updated June 16, 2026
1. Applicability
This Data Act Addendum (“Addendum”) amends the agreement (“Agreement”) between Cloudflare, Inc., a Delaware company with its principal office at 101 Townsend Street, San Francisco, CA 94107 (“Cloudflare”) and Customer (interchangeably, “Customer” or “You”). This Addendum applies solely to the provision of “Relevant Services” (defined below) to Customers who live or are headquartered in the European Union and who have billing addresses in the European Union. This Addendum’s terms apply only to Agreements formed or orders placed on or after September 12, 2025.
2. Definitions
All capitalized terms not defined in this Addendum have the meanings set forth in the Agreement. For the purpose of this Addendum, the following additional definitions apply:
2.1. “Cloudflare Extension Notice” shall have the meaning as defined in Section 5.2.
2.3. “Confidential Information” shall have the meaning set forth in Cloudflare’s Enterprise Subscription Agreement, available at https://www.cloudflare.com/enterpriseterms/.
2.4. “Customer Extension Notice” shall have the meaning as defined in Section 5.3.
2.5. “Data” shall have the meaning as defined in Art. 2(1) Data Act.
2.6. “Data Act” shall mean EU Regulation 2023/2854.
2.7. “Digital Assets” shall have the meaning as defined in Art. 2(32) Data Act.
2.8. “Exportable Data” shall have the meaning as defined in Art. 2(38) Data Act.
2.9. “Initial Term” shall mean the initial term of a Customer’s subscription to Relevant Services.
2.10. “Intellectual Property Rights” shall have the meaning set forth in Cloudflare’s Enterprise Subscription Agreement, available at https://www.cloudflare.com/enterpriseterms/.
2.11. “Notice Period” shall have the meaning as defined in Section 3.1.
2.12. “Renewal Term” shall mean each recurring subscription period following expiration of the Initial Term.
2.13. “Relevant Services” shall mean the Cloudflare services listed in Exhibit 1 to this Addendum and any other Cloudflare service(s) that a European court or competent authority deems, in a final, non-appealable decision, a data processing service as defined in Art. 2(8) Data Act.
2.14. “Retrieval Period” shall have the meaning as defined in Section 10.1.
2.15. “Switching” or “Switch” shall have the meaning as defined in Art. 2(34)
Data Act.
2.16. “Switching Assistance” shall have the meaning as defined in Section 4.
2.17. “Switching Notice” shall have the meaning as defined in Section 3.1
2.18. “Transitional Period” shall have the meaning as defined in Section 5.
3. Initiation of the Switching, Switching Notice
3.1. Customer shall give Cloudflare a notice that it initiates Switching to replace one or more Relevant Service(s) no later than 2 (two) months prior to the initiation of Switching (“Switching Notice”, “Notice Period”).
3.2. Customer shall specify in the Switching Notice:
3.2.1. the Relevant Service(s), Data, or Digital Assets that it wishes to Switch;
3.2.2. whether Customer intends to (a) Switch to a different service provider and shall in this case provide the necessary details of the new service provider, (b) whether Customer wishes to Switch to an onpremises ICT infrastructure of Customer or, (c) whether Customer does not wish to Switch but only to erase its Exportable Data and Digital Assets; and
3.2.3. Customer’s desired time window(s) for Switching (i.e., a weekday during which Customer intends to make its systems unavailable for the users and no update occur so that Customer may carry out the Switching) and, if applicable, support/assistance requested by Customer from Cloudflare in such time windows.