Data processing agreement (dpa) — FigJam

Cited by

Facts read from this source

• DPA last updated Report an error

  “Last updated: March 30, 2026”

• DPA role Report an error

  “As a Processor, Figma will process Personal Data contained in Customer Content (including Personal Data of Customer’s logged-in Authorized Users) only: (i) in accordance with documented Customer Instructions, or (ii) to comply with Figma’s obligations under applicable laws and regulations.”

• Breach notification Report an error

  “Figma must notify Customer without undue delay and, where feasible, within 72 hours after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Content processed by Figma and/or its Sub-processors”

• List URL Report an error

  “Figma maintains an up-to-date list of Sub-processors, available at https://www.figma.com/sub-processors which contains details about Sub-processor functions, the location of processing, and a mechanism for Customers to subscribe to notification of new Sub-processors or replacement of existing Sub-processors.”

• Change notice period Report an error

  “At least fifteen (15) days before a new Sub-processor begins processing Customer Content, Figma will add the Sub-processor to its sub-processor list and, if Customer has subscribed to notifications, provide Customer with written notice”

• Objection remedy Report an error

  “If Figma and Customer cannot reach a resolution within the Sub-processor Notice Period, Figma may proceed with the appointment of the Sub-processor and Customer, as its sole and exclusive remedy, may terminate the applicable Order for the affected services by providing written notice to Figma.”

• Deletion return period Report an error

  “At the end of providing the Figma Platform to Customer, Figma will, as directed by Customer and at Customer’s option, delete or return all Customer Content within thirty (30) days.”

• Audit reports annual Report an error

  “Figma uses independent third-party auditors to verify the adequacy of its technical and organizational measures. Audits are performed at least once per calendar year at Figma’s expense.”

• Customer audit terms Report an error

  “Any audit must be: (i) subject to reasonable confidentiality controls; (ii) conducted during Figma’s regular business hours; (iii) with 45 days’ advance written notice; (iv) limited to once per year (unless required by a regulator or government authority); and (v) carried out in a manner that prevents unnecessary disruption to Figma’s operations.”

• Data subject rights assistance Report an error

  “Taking into account the nature of the processing, Figma will provide reasonable and timely assistance to Customer to enable Customer to respond to requests from individuals exercising their rights”

• Government request handling Report an error

  “Figma will (i) promptly notify Customer unless legally prohibited from doing so; (ii) where permitted, refer the requesting party to Customer; (iii) use reasonable efforts to challenge any request that is unlawful, disproportionate, or overbroad; and (iv) not disclose Personal Data contained in Customer Content unless required to do so by law.”

• Brazil lgpd Report an error

  ““Data Protection Law” includes Lei Geral de Proteção de Dados Pessoais (LGPD).”

• EU sccs modules Report an error

  “(i) Module Two (Controller to Processor) applies where Customer acts as a Controller and Figma acts as a Processor with respect to the Personal Data in Customer Content. (ii) Module Three (Processor to Processor) applies where Customer acts as a Processor and Figma acts as a Sub-processor”

• UK addendum Report an error

  “The UK International Data Transfer Addendum to the EU SCCs (“UK Addendum”) will apply to Personal Data that is transferred from the United Kingdom”

• US state privacy Report an error

  “Where Personal Data in Customer Content is subject to any applicable state privacy laws (“U.S. State Privacy Laws”) and Figma acts as a Service Provider or Processor on behalf of Customer, Figma will process such Personal Data in compliance with applicable U.S. State Privacy Laws”

• US no sale Report an error

  “(b) “sell” or “share” such Personal Data within the meaning of applicable U.S. State Privacy Laws;”

• Data privacy framework Report an error

  “Figma certifies compliance with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework program administered by the US Department of Commerce”

• Processor entity Report an error

  “Name: Figma, Inc.”

• Encryption Report an error

  “Encryption of Customer Personal Data at rest and in transit (TLS/SSL and AES-256 or equivalent) and other measures consistent with industry standards.”

• Certifications Report an error

  “Implementation of a comprehensive security program, including regular risk assessments, vulnerability scanning, and independent audits (e.g., SOC 2 Type 2, ISO 27001, and ISO 27018 certifications).”

• Sensitive data not processed Report an error

  “Figma does not intend to receive or process sensitive or special categories of data.”

• Transfer frequency Report an error

  “4. The frequency of the transfer: Continuous.”

• Self service deletion Report an error

  “Customer can access, correct, return, or delete Customer Personal Data using the self-service functionality of the Figma Platform”

• Pre termination self service deletion Report an error

  “Prior to the termination of the Agreement, Figma will process Customer Content until Customer elects to delete such Customer Content via the self-service tools within the Figma Platform.”

• Affiliates permitted Report an error

  “Customer further agrees that Figma may engage its affiliates as Sub-processors.”

• Figma liability Report an error

  “(ii) remain liable to Customer where a Sub-processor fails to fulfill its data protection obligations.”

• Previous version date Report an error

  “September 15, 2025”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Microsoft 365 Admin Security, AI controls & deployment
• The Microsoft 365 Admin European sovereignty
• The Product Team Lead Security, AI controls & deployment
• The Product Team Lead European sovereignty
• The Public-Sector Project Lead Security, AI controls & deployment
• The Public-Sector Project Lead European sovereignty
• The Skeptic Security, AI controls & deployment
• The Skeptic European sovereignty
• The Works Council Member Security, AI controls & deployment
• The Works Council Member European sovereignty
• The Workshop Facilitator Security, AI controls & deployment
• The Workshop Facilitator European sovereignty