Figma Legal
The information provided here is for Figma customers and users who have questions about our terms, policies, intellectual property, and compliance.
Data Processing Addendum
Last updated: March 30, 2026
This Data Processing Addendum (“Addendum”) forms part of the agreement(s) between Customer and Figma covering Customer’s use of the Figma Platform to which this Addendum is incorporated (“Agreement”) and governs Figma’s processing of Personal Data in Customer Content.
1. Processing of Personal Data.
1.1. Description of Processing Activities. Details about processing activities, such as categories of data subjects and Personal Data processed are found in Schedule 1 (Description of Processing).
1.2. Figma’s Role. As a Processor, Figma will process Personal Data contained in Customer Content (including Personal Data of Customer’s logged-in Authorized Users) only: (i) in accordance with documented Customer Instructions, or (ii) to comply with Figma’s obligations under applicable laws and regulations.
**1.3. Compliance with Law. **Figma and Customer will each comply with Data Protection Law. Customer is responsible for ensuring Customer Instructions comply with Data Protection Law. Figma will notify Customer if it determines that an instruction infringes Data Protection Law.
1.4. Confidentiality. Figma must ensure that persons authorized to process Customer Content are subject to written or statutory obligations of confidentiality.
2. Security and Security Incidents.
2.1. Security Measures. Figma has implemented and will maintain appropriate technical and organizational measures designed to protect the security, confidentiality, integrity, and availability of Customer Content.
2.2 Security Incidents. Figma must notify Customer without undue delay** **and, where feasible, within 72 hours after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Content processed by Figma and/or its Sub-processors (“Security Incident”). Figma will use commercially reasonable efforts to investigate and identify the root cause of the Security Incident, and, to the extent within Figma's reasonable control, take reasonable and appropriate steps to mitigate and remediate the effects of the Security Incidents.
3. Sub-processors.
**3.1 General Authorization. **Customer generally authorizes Figma to engage third-party service providers to process Customer Content (each, a “Sub-processor”). Customer further agrees that Figma may engage its affiliates as Sub-processors.
3.2. Written Agreement. Figma will: (i) enter into written agreements with each Sub-processor that impose data protection obligations consistent with this Addendum; and (ii) remain liable to Customer where a Sub-processor fails to fulfill its data protection obligations.
**3.3. Sub-processor List. **Figma maintains an up-to-date list of Sub-processors, available at https://www.figma.com/sub-processors which contains details about Sub-processor functions, the location of processing, and a mechanism for Customers to subscribe to notification of new Sub-processors or replacement of existing Sub-processors.
3.4. Notification of Changes. At least fifteen (15) days before a new Sub-processor begins processing Customer Content, Figma will add the Sub-processor to its sub-processor list and, if Customer has subscribed to notifications, provide Customer with written notice (“Sub-processor Notice Period”).