Home
Stay organized with collections
Save and categorize content based on your preferences.
Data Processing
Addendum for SecOps Consulting Services and Managed
Services
Last modified: October 05, 2023
This is not the current version of this document
and is provided for archival purposes.
View the current version
Covered services: Consulting Services and Managed
Services (as defined below)
These Data Processing and Security Terms, including
their appendices (the “Terms”) reflect the parties’
agreement with respect to the processing and security of
Customer Data for Consulting Services and Managed
Services, and are incorporated into the agreement under
which Google has agreed to provide such Services to
Customer (“the Agreement”).
- Commencement
These Terms will be effective and replace any previously
applicable data processing and security terms from the
Terms Effective Date (as defined below) for Consulting
Services and/or Managed Services, as applicable, when and
to the extent there is a direct conflict.
- Definitions
2.1 Unless otherwise defined in these Terms, capitalized
terms defined in the Agreement apply to these Terms. In
addition, in these Terms:
- Adequate Country* *means:
(a) for data processed
subject to the EU GDPR: the EEA, or a country or territory
recognized as ensuring adequate protection under the EU
GDPR;
(b) for data processed
subject to the UK GDPR: the UK, or a country or territory
recognized as ensuring adequate protection under the UK
GDPR and the Data Protection Act 2018; and/or
(c) for data processed
subject to the Swiss FADP: Switzerland, or a country or
territory that is: (i) included in the list of the states
whose legislation ensures adequate protection as published
by the Swiss Federal Data Protection and Information
Commissioner, if applicable, or (ii) recognized as
ensuring adequate protection by the Swiss Federal Council
under the Swiss FADP; in each case, other than on the
basis of an optional data protection framework.
-
Alternative Transfer Solution means a
solution, other than SCCs, that enables the lawful
transfer of personal data to a third country in
accordance with European Data Protection Law, for
example a data protection framework recognized as
ensuring that participating entities provide adequate
protection.
-
*Audited Services *means the then-current
Services indicated as being in-scope for the relevant
certification or report at
https://cloud.google.com/security/compliance/secops/services-in-scope.
Google may not remove a Service from this URL unless
that Service has been discontinued in accordance with
the Agreement.
- Consulting Services means the then-current
advisory and implementation services described at
https://cloud.google.com/terms/secops/services
or in an applicable Order Form.
-
Customer Data means data provided by or on
behalf of Customer or Customer End Users in connection
with receiving Consulting Services and/or Managed
Services, as applicable, as further described in the
applicable Statement of Work.
-
Customer Personal Data means the personal
data contained within the Customer Data, including any
special categories of personal data defined under
European Data Protection Law.
-
Customer SCCs means the SCCs
(Controller-to-Processor), the SCCs
(Processor-to-Processor) and/or the SCCs
(Processor-to-Controller), as applicable.
-
Data Incident means a breach of Google’s
security leading to the accidental or unlawful