Home
Stay organized with collections
Save and categorize content based on your preferences.
Data Processing and
Security Terms (Customers)
Last modified: September 24, 2021
This is not the current version of this document and is provided for archival
purposes.
View the current version
These Data Processing and Security Terms, including their
appendices (the “Terms”) are incorporated into the
agreement under which Google has agreed to provide Google
Cloud Platform (as described at
https://cloud.google.com/terms/services)
and related technical support to Customer (the
“Agreement”).
1. Commencement
These Terms will be effective and replace any previously
applicable data processing and security terms from the Terms
Effective Date (as defined below).
2. Definitions
2.1 Capitalized terms defined in the Agreement apply to these
Terms. In addition, in these Terms:
-
*Additional Security Controls *means security
resources, features, functionality and/or controls that
Customer may use at its option and/or as it determines,
including the Admin Console, encryption, logging and
monitoring, identity and access management, security scanning,
and firewalls.
-
Adequate Country means:
(a) for data processed subject to
the EU GDPR: the EEA, or a country or territory that is the
subject of an adequacy decision by the Commission under Article
45(1) of the EU GDPR;
(b) for data processed subject to
the UK GDPR: the UK or a country or territory that is the
subject of the adequacy regulations under Article 45(1) of the
UK GDPR and Section 17A of the Data Protection Act 2018;
and/or
(c) for data processed subject to
the Swiss FDPA: Switzerland, or a country or territory that (i)
is included in the list of the states whose legislation ensures
an adequate level of protection as published by the Swiss
Federal Data Protection and Information Commissioner, or (ii) is
the subject of an adequacy decision by the Swiss Federal Council
under the Swiss FDPA.
-
Alternative Transfer Solution means a solution,
other than SCCs, that enables the lawful transfer of personal
data to a third country in accordance with European Data
Protection Law.
-
Audited Services means the then-current Services
indicated as being in-scope for the relevant certification or
report at
https://cloud.google.com/security/compliance/services-in-scope.
Google may not remove a Service from this URL unless that
Service has been discontinued in accordance with the
Agreement.
-
Customer Data has the meaning given in the
Agreement or, if no such meaning is given, means data provided
by or on behalf of Customer or Customer End Users via the
Services under the Account.
-
Customer End Users has the meaning given in the Agreement
or, if not such meaning is given, has the meaning given to
“End Users” in the Agreement.
-
Customer Personal Data means the personal data
contained within the Customer Data, including any special
categories of personal data defined under European Data
Protection Law.
-
Customer SCCs means the SCCs (EU Controller-to-Processor),
the SCCs (EU Processor-to-Processor), the SCCs (EU
Processor-to-Controller), and/or the SCCs (UK
Controller-to-Processor), as applicable.
-
Data Incident means a breach of Google’s security
leading to the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or access to, Customer
Data on systems managed by or otherwise controlled by Google.
-
EEA means the European Economic Area.