Home
Stay organized with collections
Save and categorize content based on your preferences.
SecOps Services Data
Processing and Security Terms (Customers)
Last modified: February 06, 2023
This is not the current version of this document and is
provided for archival purposes.
View the current version
Covered services: Chronicle SIEM, Chronicle SOAR,
Mandiant Solutions
These Data Processing and Security Terms, including
their appendices (the “Terms”) are incorporated
into the agreement under which Google has agreed to
provide the Services and related technical support to
Customer (the “Agreement”).
- Commencement
These Terms will be effective and replace any previously
applicable data processing and security terms from the
Terms Effective Date (as defined below).
- Definitions
2.1 Capitalized terms defined in the Agreement apply to
these Terms. In addition, in these Terms:
-
Additional Security Controls means security
resources, features, functionality and/or controls that
Customer may use at its option and/or as it determines,
including encryption, logging, monitoring, and security
scanning.
-
Adequate Country means:
(a) for data processed
subject to the EU GDPR: the EEA, or a country or territory
recognized as ensuring adequate protection under the EU
GDPR;
(b) for data processed
subject to the UK GDPR: the UK, or a country or territory
recognized as ensuring adequate protection under the UK
GDPR and the Data Protection Act 2018; and/or
(c) for data processed
subject to the Swiss FDPA: Switzerland, or a country or
territory that is: (i) included in the list of the states
whose legislation ensures adequate protection as published
by the Swiss Federal Data Protection and Information
Commissioner, or (ii) recognized as ensuring adequate
protection by the Swiss Federal Council under the Swiss
FDPA;
in each case, other than on
the basis of an optional data protection framework.
-
Alternative Transfer Solution means a solution,
other than SCCs, that enables the lawful transfer of
personal data to a third country in accordance with
European Data Protection Law, for example a data
protection framework recognized as ensuring that
participating entities provide adequate protection.
-
Audited Services means the then-current
Services indicated as being in-scope for the relevant
certification or report at
https://cloud.google.com/security/compliance/secops/services-in-scope.
Google may not remove a Service from this URL unless
that Service has been discontinued in accordance with
the Agreement.
-
*Customer Data *has the meaning given in the
Agreement or, if no such meaning is given, means data
provided by or on behalf of Customer or Customer End
Users via the Services under the Account.
-
Customer End Users has the meaning given in the
Agreement or, if no such meaning is given, has the
meaning given to “End User(s)” in the Agreement.
-
Customer-Engaged Provider means a service
provider (which may include a processor or subprocessor)
directly engaged by Customer under a separate agreement
between Customer and such provider, and not these Terms.
-
Customer Personal Data means the personal data
contained within the Customer Data, including any
special categories of personal data defined under
European Data Protection Law.
-
Customer SCCs means the SCCs
(Controller-to-Processor), the SCCs
(Processor-to-Processor), and/or the SCCs (EU
Processor-to-Controller), as applicable.
-
Data Incident means a breach of Google’s