Home
Stay organized with collections
Save and categorize content based on your preferences.
Data Processing and
Security Terms (Customers)
Last modified: June 30, 2022
This is not the current version of this document and is provided for archival
purposes.
View the current version
These Data Processing and Security Terms, including
their appendices (the “Terms”) are incorporated
into the agreement under which Google has agreed to
provide Google Cloud Platform (as described at
https://cloud.google.com/terms/services)
and related technical support to Customer (the
“Agreement”).
- Commencement
These Terms will be effective and replace any previously
applicable data processing and security terms from the
Terms Effective Date (as defined below).
- Definitions
2.1 Capitalized terms defined in the Agreement apply to
these Terms. In addition, in these Terms:
-
*Additional Security Controls *means security
resources, features, functionality and/or controls that
Customer may use at its option and/or as it determines,
including the Admin Console, encryption, logging and
monitoring, identity and access management, security
scanning, and firewalls.
-
Adequate Country means:
(a) for data processed
subject to the EU GDPR: the EEA, or a country or territory
that is the subject of an adequacy decision by the
Commission under Article 45(1) of the EU GDPR;
(b) for data processed
subject to the UK GDPR: the UK or a country or territory
that is the subject of the adequacy regulations under
Article 45(1) of the UK GDPR and Section 17A of the Data
Protection Act 2018; and/or
(c) for data processed
subject to the Swiss FDPA: Switzerland, or a country or
territory that (i) is included in the list of the states
whose legislation ensures an adequate level of protection
as published by the Swiss Federal Data Protection and
Information Commissioner, or (ii) is the subject of an
adequacy decision by the Swiss Federal Council under the
Swiss FDPA.
-
Alternative Transfer Solution means a
solution, other than SCCs, that enables the lawful
transfer of personal data to a third country in
accordance with European Data Protection Law.
-
Audited Services means the then-current
Services indicated as being in-scope for the relevant
certification or report at
https://cloud.google.com/security/compliance/services-in-scope.
Google may not remove a Service from this URL unless
that Service has been discontinued in accordance with
the Agreement.
-
Customer Data has the meaning given in the
Agreement or, if no such meaning is given, means data
provided by or on behalf of Customer or Customer End
Users via the Services under the Account.
-
Customer End Users has the meaning given in the
Agreement or, if not such meaning is given, has the
meaning given to “End Users” in the Agreement.
-
Customer Personal Data means the personal
data contained within the Customer Data, including any
special categories of personal data defined under
European Data Protection Law.
-
Customer SCCs means the SCCs (EU
Controller-to-Processor), the SCCs (EU
Processor-to-Processor), the SCCs (EU
Processor-to-Controller), and/or the SCCs (UK
Controller-to-Processor), as applicable.
-
Data Incident means a breach of Google’s
security leading to the accidental or unlawful
destruction, loss, alteration, unauthorized disclosure
of, or access to, Customer Data on systems managed by or
otherwise controlled by Google.
-
EEA means the European Economic Area.