Data Processing Addendum
On this page
RUDDERSTACK DATA PROCESSING ADDENDUM (LAST UPDATED OCTOBER 13, 2026)
This Data Processing Addendum (“DPA”) forms part of the agreement between RudderStack, Inc. (“Processor”) and the entity identified as Customer (“Customer”), whether that agreement is (a) the RudderStack Terms of Service available at https://www.rudderstack.com/terms-of-service (the “Terms of Service”), or (b) a master services agreement, subscription agreement, or other written agreement executed between Processor and Customer that incorporates one or more Order Forms (each, an “MSA”) (in each case, the “Agreement”). “Order Form” means an ordering document executed by both parties under an Agreement. This DPA applies where Processor processes Personal Data on behalf of Customer (including authorized affiliates of Customer) in connection with the Services.
1. DEFINITIONS
Capitalized terms not defined here have the meaning given in the Agreement.
1.1 “Applicable Data Protection Laws” means all laws applicable to the Processing of Personal Data under the Agreement, including:
- Regulation (EU) 2016/679 (“GDPR”)
- UK GDPR and Data Protection Act 2018
- Swiss Federal Act on Data Protection (revFADP)
- U.S. state privacy laws (including CCPA/CPRA)
- Any successor or replacement legislation
1.2 “Controller”, “Processor”, “Subprocessor”, “Personal Data”, “Data Subject” and “Processing” each have the meanings given in Applicable Data Protection Laws.
1.3 “Security Incident” means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by Processor. The definition specifically excludes unsuccessful attempts that do not compromise Personal Data.
2. ROLE OF THE PARTIES
2.1 Controller–Processor Relationship
With respect to Customer Personal Data:
-
Customer acts as Controller or Processor.
-
Processor acts solely as Processor (or Subprocessor, where Customer is a Processor and has documented authority from a Controller).
Processor shall process Personal Data:
-
Only on documented instructions from Customer;
-
For the purpose of providing the Services (including, where Customer has enabled them, the AI Features described in §2.4, and, where Customer uses it, Lookout as described in §2.5);
-
In compliance with Article 28(3) GDPR and equivalent UK and Swiss requirements.
Customer's documented instructions to Processor under Article 28(3) GDPR consist of: (i) the Agreement and this DPA; (ii) for Customers under an MSA, the applicable Order Form and any written change orders or statements of work executed by both parties; (iii) the source, destination, tracking-plan, transformation, and AI Feature configurations (including enabling or disabling AI Features for a workspace) established by Customer through the Account; (iv) Personal Data and processing parameters submitted through the Services; (v) where Customer has enabled AI Features, the instructions set forth in §2.4; and (vi) where Customer uses Lookout, the warehouse connections, credentials, and permissions Customer configures in the Account and makes available to Lookout, the Audiences and Activations (including destinations, sync schedules, approvals, and automation settings) that Customer’s Users create, approve, or configure, and the instructions set forth in §2.5. Instructions outside the foregoing must be agreed in writing by both parties.
2.2 Processor Restrictions