## Snowflake Data Protection Impact Assessment (DPIA) Fact Sheet 1 This DPIA Fact Sheet is intended as guidance and for exemplary purposes only. Each organization should conduct its DPIA in accordance with its own unique processes, use cases, data, and interpretation of the requirements of Art. 37 of the GDPR. | DPIA Requirements &Sub-requirements | Snowflake Customer DPIA Response | |---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | A systematic description of the processing is provided (Art. 35(7)(a)): | Provide a systematic description of your use of Snowflake: | | ฀ Nature, scope, context and purposes of the processing are taken into account (Recital 90); | ฀ Snowflake MSA / Terms of Service / DPA Annex 2, Determined by customer; | | ฀ Personal data, recipients and period for which the personal data will be stored are recorded; | ฀ Determined by customer; | | ฀ A functional description of the processing operation is provided; | ฀ Determined by customer (commonly, data analytics, data science); | | ฀ The assets on which personal data rely (hardware, software, networks, people, paper or paper transmission channels) are identified; | ฀ Determined by customer (commonly, data sources, transfer tools, the Snowflake service, customer-selected cloud hosting &infrastructure provider, BI tools); | | ฀ Compliance with GDPR-approved codes of conduct is taken into account (Art. 35(8)). | ฀ No codes of conduct or certifications specifically applicable to Snowflake have been approved under the GDPR at this time, but if a code of conduct applicable to your organization has been approved, you can describe your compliance with it here and the effects of your compliance on data protection. | | Necessity and proportionality are assessed (Art. 35(7)(b)): | Assess the necessity and proportionality of the processing your organization performs in Snowflake: | | ฀ Measures contributing to the proportionality and the necessity of the processing on the basis of: | ฀ Necessity and proportionality: | | o Specified, explicit and legitimate purpose(s) (Art. 5(1)(b)); | o Determined by customer (e.g., product improvement, customer service); | | o Lawfulness of processing (Art. 6); | o Determined by customer (e.g., consent, legitimate interest); | | o Adequate, relevant and limited to what is necessary data (Art. 5(1)(c)); | o Determined by customer (e.g., data processed is directly related to the purposes identified); | | o Limited storage duration (Art. 5(1)(e)). | o Determined by customer (e.g., data deleted after data is no longer relevant and/or in compliance with customer's data retention policy). | | ฀ Measures contributing to the rights of the data subjects: o Information provided to the data subject (Art. 12-14); | ฀ Rights of data subjects: o Determined by customer (e.g., Privacy Notice, Cookie Notice); | | o Right of access and to data portability (Art. 15, 20); | o The right of access and to data portability, as well as all other data subject rights, can be fulfilled by the customer in the Snowflake service; | | o Right to rectification and to erasure (Art. 16, 17, 19); | o The right of access and to data portability, as well as all other data subject rights, can be fulfilled by the customer in the Snowflake service; | 1 This DPIA Fact Sheet is based on Annex 2 of the Article 29 Working Party (Now European Data Protection Board) 'Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679'. | o Right to object and to restriction of processing (Art. 18, 19, 21); | o The right to object and to restriction of processing, as well as all other data subject rights, can be fulfilled by the customer in the Snowflake service; | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | o Relationships with processors (Art. 28); | o Information about Snowflake sub-processors can be found here; | | o Safeguards surrounding international transfer(s) (Chap. V); | o Please see Snowflake's DPA containing Standard Contractual Clauses (which is incorporated by reference into customer contracts) here, Privacy Shield certification here, and Privacy Shield Statement here. While Privacy Shield has been invalidated as a transfer mechanism by the ECJ as of July 16, 2020, the U.S. Department of Commerce will continue to administer the framework and Snowflake will continue to abide by the Privacy Shield Principles, which act as safeguards facilitating international transfers. | | o Prior consultation (Art. 36). | o Prior consultation is determined by customer based on the risks identified during its DPIA of its particular use of Snowflake. | | Risks to the rights and freedoms of data subjects are managed (Art. 35(7)(c)): | Describe how your organization manages risks to the rights and freedoms of data subjects: | | ฀ Origin, nature, particularity and severity of the risks are appreciated (Rec. 84) or, more specifically, for each risk (illegitimate access, undesired modification, and disappearance of data) from the perspective of the data subjects: | ฀ Origin, nature, particularity and severity of the risks of illegitimate access, undesired modification, and disappearance of data: | | o Risk sources are taken into account (Rec. 90); | o Determined by customer's configuration , integrations, and security practices (e.g., insider threat, insufficient monitoring); | | o Potential impacts to the rights and freedoms of data subjects are identified in case of events including illegitimate access, undesired modification and disappearance of data; | o Determined by customer data processed (e.g., fraud, identity theft, reputational damage); | | o Threats that could lead to illegitimate access, undesired modification and disappearance of data are identified; | o Customer to identify most probable threats in customer's environment (e.g., inadequate controls, stolen laptop); | | o Likelihood and severity are estimated (Rec. 90); | o Generated using above information and any other relevant factors in customer's environment; | | o Measures envisaged to treat those risks are determined (Art. 35(7)(d) and Rec. 90). | o This will depend on the customer's configuration and security controls. Some controls available to Snowflake customers include encryption in transit and at rest, role-based access controls, auditability, multi- factor authentication, logging and monitoring, and IP whitelisting. | | Interested parties are involved: | Involve interested parties: | | ฀ The advice of the DPO is sought (Art. 35(2)); | ฀ Review the DPIA results with your DPO (if applicable); if you do not have a DPO, review them with the resource responsible for privacy compliance in your organization, such as a Chief Privacy Officer; | | ฀ The views of data subjects or their representatives are sought, where appropriate (Art. 35(9)). | ฀ If appropriate, consult your customers / users / data subjects about the processing performed (e.g., Snowflake leverages its customer users' responses to voluntary customer surveys to facilitate meeting its own consultation requirement). |