September 20, 2022

Home

Stay organized with collections

Save and categorize content based on your preferences.

Cloud Data Processing

Addendum (Customers)

Last modified: September 20, 2022

This is not the current version of this document and is provided for archival purposes.

View the current version

This Cloud Data Processing Addendum including its appendices (“Addendum”) is incorporated into the Agreement(s) under which Google has agreed to provide Google Cloud Platform, Google Workspace, or Cloud Identity (each as defined below), as applicable (the “Services”), to Customer. This Addendum was formerly known as the “Data Processing and Security Terms” under an Agreement for Google Cloud Platform and the “Data Processing Amendment” under an Agreement for Google Workspace or Cloud Identity.

1. Commencement

This Addendum will be effective and replace any terms previously applicable to the processing of Customer Data, including any Data Processing and Security Terms or Data Processing Amendment, from the Addendum Effective Date (as defined below).

2. Definitions

2.1 Capitalized terms used but not defined in this Addendum have the meaning given to them in the Agreement:

• Account has the meaning given in the applicable Agreement or, if no such meaning is given, means Customer’s Google Cloud Platform account, Google Workspace account or Cloud Identity account, as applicable.

• Addendum Effective Date means the date on which Customer accepted, or the parties otherwise agreed to, this Addendum.

• *Additional Security Controls *means security resources, features, functionality and/or controls that Customer may use at its option and/or as it determines, including the Admin Console, encryption, logging and monitoring, identity and access management, security scanning, and firewalls.

• *Adequate Country *means:

(a) for data processed subject to the EU GDPR: the EEA, or a country or territory recognized as ensuring adequate protection under the EU GDPR;

(b) for data processed subject to the UK GDPR: the UK, or a country or territory recognized as ensuring adequate protection under the UK GDPR and the Data Protection Act 2018; and/or

(c) for data processed subject to the Swiss FDPA: Switzerland, or a country or territory that is: (i) included in the list of the states whose legislation ensures adequate protection as published by the Swiss Federal Data Protection and Information Commissioner, or (ii) recognized as ensuring adequate protection by the Swiss Federal Council under the Swiss FDPA;

in each case, other than on the basis of an optional data protection framework.

• Alternative Transfer Solution means a solution, other than SCCs, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Law, for example a data protection framework recognized as ensuring that participating entities provide adequate protection.

• Audited Services means the then-current Services indicated as being in-scope for the relevant certification or report at https://cloud.google.com/security/compliance/services-in-scope. Google may not remove any Services from this URL unless those Services have been discontinued in accordance with the applicable Agreement.

• Cloud Identity means the Cloud Identity Services described at https://cloud.google.com/terms/identity/user-features, when purchased under a standalone Agreement.

• Customer Data has the meaning given in the applicable Agreement or, if no such meaning is given,