DOCKER DATA PROCESSING AGREEMENT
Last updated August 26, 2026
This Data Processing Agreement for Docker Services ('DPA') forms a part of the software subscription agreement or other written agreement between Docker and Customer ('Agreement') regarding Docker's subscriptions and/or products or services provided by Doc ker and ordered by Customer (the 'Service') in accordance with the Agreement. All contacts regarding this DPA must be made to: privacy@docker.com.
1. DEFINITIONS
Capitalized terms shall have the meaning set out below. Any capitalized terms not defined in this DPA shall have the meaning set out in the Agreement or as otherwise defined in the applicable data protection laws:
'Breach Event': a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Personal Data transmitted, stored, or otherwise processed by Docker.
'CCPA' refers to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
'Controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
'Customer' means the entity using the Docker Services that has executed an Agreement, which references this DPA.
'Customer Content': any data, files, code, prompts submitted to or outputs received from AI models, sandbox images, or snapshots submitted to, stored in, or generated within the Service by or on behalf of Customer or its end users, including any Personal Data contained therein.
'Laws' means applicable data protection laws and regulations.
'Processing': any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
'Personal Data': any information relating to an identified or identifiable natural person ('Data Subject' or 'PII Principal') that is Processed by Processor on behalf of the Customer pursuant to the Agreement; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier.
'Processor': Docker as the legal person who processes the Personal Data on behalf of the Customer.
'Standard Contractual Clauses' or 'SCCs': (i) the Standard Contractual Clauses approved by the Commission Decision 2021/914 of 4 June 2021 for the transfer of personal data to third countries pursuant to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC ('GDPR') and (ii) the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses issued by the Information Commissioner's Office in the United Kingdom ('UK SCCs').
'Sub -Processor': an entity engaged by the Processor exclusively for the Processing activities to be carried out pursuant to or in connection with the Agreement on behalf of the Controller and in accordance with its instructions, as transmitted by the Controller.